The Bank of Thailand (BOT), the country's central bank, has called Thai financial institutions to a cyber-security meeting after IT outages and cyber attacks hit financial institutions abroad. Suwannee Jessadasak, BOT Deputy Governor for Financial Institutions Stability, said on 9 November 2026 that the BOT is closely monitoring the situation and has found no impact on services at financial institutions in Thailand so far. For anyone who uses a Thai banking app, the guidance below covers what banks must do and what you can do yourself.
The BOT did not say which foreign institution was hit, in which country, or what kind of attack it was. It also did not name any Thai bank as being at special risk. This is a story about advance preparation, not an announcement that Thailand's banking system has a problem.
BOT calls banks to a meeting
The BOT convened the chief information officers (CIOs) of all financial institutions. The Thailand Banking Sector CERT (TB-CERT), the sector's cyber-security coordination centre, and the Thai Bankers' Association also took part. The aim is to tighten defences against cyber threats, watch for possible attacks, share relevant information and assess the situation in line with the level of risk.
The BOT and the institutions will keep tracking cyber developments. They will focus on keeping IT and cyber systems running to the required standards. They will also keep rehearsing emergency plans for key payment systems under their Business Continuity Plans (BCP). The BOT said the safety of the public's use of financial services is a priority.
This work sits mainly on the banks' side. For what users can do, the BOT has published guidance before, covered below.
What banks must do under earlier BOT rules
The BOT earlier set minimum practices for all financial institutions in BOT news release No. 10/2566, dated 9 March 2023. They cover three areas: prevention, detection and response.
Several prevention rules directly affect users:
- Banks must not send links of any kind by SMS or email.
- Banks must not ask for sensitive data, such as passwords and ID card numbers, over social media.
- Each mobile banking username can be used on only 1 device.
- Customers must be alerted before every transaction.
The same rules call for stronger identity checks. These include face scans for opening accounts through an app and for qualifying transactions. Banks also set a maximum daily withdrawal or transfer limit based on each user group's risk level, and customers can ask to change it if needed.
On detection, banks must run near real-time systems that monitor suspicious accounts and transactions, so they can pause a transaction at once. On response, banks must run a hotline that operates 24 hours and is separate from normal service channels, so users can report problems quickly. Banks must also take responsibility for customers if the loss results from the institution's own failings.
The 2023 package is not necessarily the latest rule. In 2025 the BOT said it would issue new standards for commercial banks in early May 2025 under the related emergency decree. The new standards focus on account impersonation, transfer alerts and hotlines.
What users can do themselves
In a news release on 28 April 2025, the BOT asked the public to stay alert. Steps you can take right away:
- Do not tap links from unknown senders.
- Beware of phone calls from people pretending to be an agency or another person.
- Check transaction details carefully before confirming every time.
- If you have already been scammed, call 1441, the Anti-Online Scam Operation Center (AOC), to report to the police. Also tell the bank that holds the destination account so it can freeze that account.
The BOT said that the faster a case is reported, the better the chance of holding the money in time. If you have already transferred money, time matters.
The 2023 rule that banks should not send links by SMS or email also makes decisions easier. If an SMS or email claims to be from your bank and includes a link to enter sensitive details, treat it as a likely scam. Under those rules, banks should not send such links in the first place.
If an app is down or you get a message citing the incident
If you receive a message or call that uses this news as a hook, apply the same rules the BOT repeated in 2025: do not tap unknown links, and be wary of callers posing as an agency or another person. The BOT has not announced any dedicated channel for checking whether a banking app is down, and it currently sees no impact on services in Thailand.
A typical scam message says a bank has been attacked and asks you to tap a link to verify your identity. A simple test is to see whether there is a link to tap and whether you are asked for sensitive data. If you are unsure, check the transaction details carefully before you confirm, as the BOT has advised.
Contacting your bank's own hotline when in doubt is general practice based on the 24-hour hotline requirement in the 2023 rules. It is not BOT advice for this particular incident. The BOT's statements do not say whether 1441 or bank hotlines offer English-language support, so check with your bank or the agency. The BOT said it will keep monitoring and rehearsing emergency plans for key payment systems so they keep running.
Source: Bank of Thailand (BOT news release No. 10/2566 dated 9 March 2023, BOT news release of 28 April 2025) and the 9 November 2026 statement by the BOT Deputy Governor for Financial Institutions Stability.
This article is adapted from ViewNews' Thai-language report.
