Understanding Scammer Threats: Detection Strategies Aligned with Thailand’s Cybersecurity Act 2562

Understanding Scammer Threats: Detection Strategies Aligned with Thailand’s Cybersecurity Act 2562

Speakers: Teerawut Wittayakorn (Major General, NCSA (Thailand)), Saichon Saelee (Director of Cyber Coordination Office, NCSA)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=NNQIi7UpOHA

Overview

This talk, presented by Major General Teerawut Wittayakorn and Saichon Saelee from Thailand's National Cybersecurity Agency (NCSA) at FIRSTCON, addresses the rapidly escalating problem of human-centric scam threats. It provides a comprehensive overview of the scam landscape in Thailand, detailing the sophisticated techniques employed by criminal organizations and the multi-faceted strategies implemented by the Thai government to combat them. The presentation underscores the critical evolution of scams from simple financial fraud into highly organized transnational crime, deeply intertwined with human trafficking, money laundering, and broader social crises.

The speakers emphasize the profound impact of these scams, illustrated by tragic victim stories, highlighting not only immense financial losses but also severe human costs. They articulate Thailand's national agenda to counter tech crimes, outlining a four-pillar strategy encompassing cooperation, operational measures, technical interventions, and robust legal frameworks. This talk is crucial for cybersecurity professionals, policymakers, and financial institutions seeking to understand and counter the evolving tactics of cybercriminals in the context of a connected, digitally-dependent populace.

Background

▶ Watch: Scams evolved into transnational organized crime, human trafficking (2:45)

Thailand, with a population of approximately 71 million, presents a fertile ground for scammers due to its high digital penetration. The country boasts 99.5 million mobile subscribers (139% saturation), over 90% internet users, and more than 70% active social media users. Thai citizens spend an average of over 9 hours daily online, primarily using messaging apps like LINE, creating an extensive attack surface for cybercriminals. This pervasive digital presence, combined with the anonymity offered by online interactions, has facilitated an explosion in scam-related activities.

The scale of the problem is staggering: from March of last year to May of this year, Thailand recorded over 400,000 scam cases, resulting in total losses amounting to approximately 8,165 million USD (over 8 billion USD). This figure represents roughly three times the annual budget of Thailand's Ministry of Digital Economy and Society, underscoring the severe economic drain. While online sales scams account for nearly two-thirds of all cases, online investment scams are responsible for the largest financial losses. The speakers highlight that these are no longer isolated incidents of fraud but rather highly organized, transnational criminal enterprises that fuel human trafficking, launder billions through global financial networks, distort legitimate markets, and contribute to significant social crises within the nation.

Key Findings

▶ Watch: AOC's "10-minute rule" for rapid scam response (9:50)

The presentation reveals several key findings regarding both the nature of scam operations and effective countermeasures. Scammers employ a sophisticated, multi-stage approach, beginning with initial contact via phone, SMS, or social media. These interactions often involve high-pressure tactics or enticing offers (e.g., easy money, prize winnings) to direct victims to fraudulent websites or platforms designed for fake investments or online purchases. A more advanced technique involves coercing victims into downloading malicious applications that mimic legitimate services, subsequently requesting sensitive credentials, biometric data, and exploiting accessibility features for remote control and screen overlay attacks to drain bank accounts entirely.

In response, Thailand has implemented a comprehensive four-pillar strategy:

1. Cooperation: Declaring tech crime a national agenda, establishing a high-level committee led by the Prime Minister for legislative and information-sharing facilitation. This includes fostering both national (public-private) and international partnerships, such as within APEC and ASEAN, to share intelligence and coordinate joint solutions against cross-border cybercrime.
2. Operational Measures: The establishment of the Online Anti-Scam Center (AOC), operating 24/7 with a hotline (1441). The AOC’s primary functions include immediate suspension of affected bank accounts, accelerating refund processes, and leveraging technology to counter scams. Notably, the AOC handled over 3.2 million calls in its first 2.5 years, preventing approximately 650 million USD in losses last year alone. A crucial operational policy is the "10-minute rule," mandating that the AOC issue a case ID and banks initiate verification and investigation of mule accounts within 10 minutes of a victim reporting fraud, capitalizing on the short window before funds are fully transferred. A Data Exchange System shares incident information across key regulatory bodies: the Bank of Thailand, National Broadcasting and Telecommunications Commission (NBTC), Securities and Exchange Commission (SEC), and NCSA.
3. Technical Measures: Proactive steps include SIM card registration limits (maximum five per person, strict rules for minors) and the detection and eradication of SIM boxes and GSM gateways used to mask international calls. The NBTC also regulates cell tower coverage near borders to prevent cross-border exploitation. For SMS, a public declaration ensures that no official government or bank messages will contain embedded links, and Application-to-Person (A2P) SMS senders must register their names with the NBTC, with NCSA developing a web application to filter messages with unregistered senders or blacklisted links. Social media platforms are compelled to remove fraudulent accounts and pages. Critically, NCSA's technical teams reverse-engineer malicious apps to identify Command and Control (C2) servers, perform penetration testing to access victim data, and coordinate with banks to intercept illegal transactions. Biometric verification for banking has been enhanced with randomized movements (e.g., turning head, blinking) to defeat static photo/video attacks, and remote access features are disabled in banking applications.
4. Legal Frameworks: The Royal Decree on Prevention and Suppression of Cybercrime (2023) enables victims to report directly to banks for account suspension and facilitates information sharing between government agencies, bypassing previous personal data protection constraints. It also criminalizes the opening of mule accounts or registering ghost SIM cards. A second revision of this law is planned for 2025 to further accelerate refund processes and impose liability on financial institutions failing to meet transaction security standards. New social media regulations, effective November, mandate Know Your Customer (KYC) verification (facial or digital ID) for paid advertisements, require 90-day data retention for ad information, and impose legal responsibility on platforms for non-compliance, even for those operating abroad but targeting Thai users.

Technical Deep Dive

▶ Watch: Scammers' malicious apps exploiting phone accessibility features (16:00)

The sophisticated nature of modern scams necessitates an equally advanced technical response. Scammers typically initiate contact through various channels: phone calls often involve social engineering to pressure victims, while SMS messages might impersonate government agencies or banks, embedding phishing URLs that lead to fraudulent websites. Social media platforms are exploited to create compelling narratives, often leveraging stolen identities or fabricated opportunities, to lure victims into interacting with scam infrastructure.

Once victims engage, they are directed to meticulously crafted fraudulent websites or platforms designed to mimic legitimate investment opportunities, e-commerce sites, or government portals. These sites often serve as a preliminary step, encouraging victims to make small initial "investments" or purchases. A critical escalation in the attack chain involves convincing victims to download malicious applications that appear to be legitimate tools, such as utility apps (e.g., a fake electricity authority application). Upon installation, these apps aggressively request a broad range of permissions and sensitive information, including national IDs, passwords, PINs, and even biometric data like photos and videos.

A particularly insidious technique involves exploiting Android Accessibility Service features. Scammers trick victims into granting these permissions, which allows the malicious app to gain extensive control over the device. This control is then leveraged for screen sharing and screen overlay attacks. The attacker can remotely view the victim's screen, guiding them through fake transactions, or overlaying legitimate banking applications with fraudulent interfaces. This enables the criminal to capture banking credentials or even directly initiate unauthorized transfers using the victim's own banking application, often draining entire accounts. The use of two different PINs (one for the fake app, one for the banking app) and biometric verification (using captured photos/videos) further facilitates these illicit transfers.

Thailand's NCSA has developed significant technical capabilities to counter these threats. Their teams perform reverse engineering on captured malicious applications to identify their underlying infrastructure, specifically pinpointing Command and Control (C2) IPs and server functionalities. This analysis revealed two distinct C2 services commonly used: one dedicated to remote control of the victim's mobile device and another for real-time screen monitoring. Following the identification of C2 servers, NCSA conducts penetration testing to exploit vulnerabilities within these servers. Successful penetrations have allowed NCSA to access vast amounts of victim data, including personal photos, documents, and real-time screen views, mirroring what the criminals see. This intelligence is then used to coordinate with retail banks, enabling the interception of illegal transactions. While some transactions can be blocked immediately (represented by "green bars" in their internal reporting), others may not be intercepted in real-time ("red bars") but trigger immediate account freezing, allowing for potential recovery of funds.

Furthermore, the Bank of Thailand has implemented crucial technical enhancements to biometric verification processes. Previously, simple video verification could be defeated by recorded footage or deepfakes. Now, banking applications require randomized movements such as turning the head left or right, nodding, or blinking during verification. This dynamic challenge significantly disrupts the attacker's ability to use pre-recorded or synthetically generated biometric data. To address the exploitation of remote access, Thai banking applications have been hardened by disabling remote access functionalities, preventing malicious actors from taking control of legitimate banking apps even if other device permissions are compromised. In the realm of SMS security, NCSA is developing a web-based application for A2P operators. This application will verify if the sender's name in an A2P message is registered with the NBTC and if any embedded links are present in the AOC's backlisted database. Messages failing these checks will be automatically filtered and deleted, preventing large-scale phishing campaigns.

Demo / Proof of Concept

▶ Watch: New social media regulations for KYC on paid ads (33:00)

While the conference talk did not feature a live, interactive demonstration for the audience, the speakers detailed the NCSA's internal technical capabilities and findings which serve as compelling proof-of-concept for their investigative methods and the effectiveness of their countermeasures. Specifically, the NCSA's reverse engineering of malicious applications and subsequent penetration testing of Command and Control (C2) servers provided concrete evidence of scammer operations.

During their investigations, NCSA successfully identified vulnerabilities in these C2 servers, gaining unauthorized access. This access revealed a treasure trove of operational data, including numerous photos and documents directly exfiltrated from victims' mobile phones. Crucially, NCSA analysts were able to view the same real-time screen feeds that the criminals were observing from victim devices. This internal "demonstration" of access and data exfiltration validated their understanding of scammer techniques and provided actionable intelligence. The ability to intercept illegal transactions, as visualized by the "green" and "red" bars in their internal tracking, further demonstrated the practical impact of their technical interventions in coordinating with retail banks to mitigate financial losses. This hands-on technical validation underpins the confidence in Thailand's defensive strategies.

Defensive Implications

▶ Watch: Q&A: Blocking scam infrastructure, cross-border challenges (36:00)

The insights shared by the NCSA offer critical defensive implications for individuals, organizations, and governments battling cyber scams. At the foundational level, public awareness campaigns are paramount. The NCSA actively targets vulnerable demographics, particularly the elderly who may experience loneliness or loss, as they are often susceptible to emotional manipulation. Banks and government agencies regularly issue warnings through their official applications, reinforcing the message that an informed citizenry is the most effective first line of defense.

Telecom regulation is a powerful deterrent. Limiting SIM card registrations (e.g., five per person, strict controls for minors) disrupts criminals' ability to easily acquire ghost SIM cards for mule accounts or illicit communications. The clear identification of international calls (e.g., with a '+' prefix) helps users recognize potential scam attempts. Aggressive efforts to detect and eradicate SIM boxes and GSM gateways – often located in urban centers and identified through data analysis – are crucial for preventing the obfuscation of scam calls. Furthermore, regulating the range of cell towers near international borders helps prevent cross-border cellular exploitation.

For SMS security, the public declaration by the Bank of Thailand and government organizations that official messages will never contain embedded links is a simple yet powerful measure. This empowers users to immediately identify phishing attempts. The requirement for A2P SMS senders to register their names with the NBTC, coupled with NCSA's planned web application for link and sender verification, will significantly reduce the effectiveness of large-scale SMS phishing campaigns by filtering out malicious messages before they reach recipients.

Social media platforms must take greater responsibility. Thailand's new regulations mandating KYC verification (using facial recognition or digital IDs) for paid advertisements, requiring 90-day data retention, and imposing legal liability on platforms, even those operating internationally but targeting Thai users, are groundbreaking. These measures aim to disrupt scammers' ability to promote fraudulent content and hold platforms accountable. Active coordination with social media providers for rapid takedown of fraudulent accounts and pages remains essential.

Financial institutions are on the front lines. The "10-minute rule" for fraud reporting and account suspension is a best practice for rapid response. Enhancing biometric verification with randomized movements makes it significantly harder for criminals to bypass authentication using stolen or synthetic biometrics. Disabling remote access features in banking applications is a critical hardening measure against malware that exploits device control. Furthermore, clear legal definitions and severe penalties for individuals involved in mule account activities serve as a strong deterrent.

Finally, the legal framework itself is a dynamic defense. The Royal Decree on Prevention and Suppression of Cybercrime facilitates crucial information sharing among government agencies, streamlining investigations and prosecutions. The commitment to rapid legislative review (e.g., the second revision planned within two years) demonstrates an agile approach to adapting laws to the fast-evolving threat landscape. This includes extending regulatory oversight to digital assets and prohibiting peer-to-peer digital asset exchanges to close money laundering avenues. Collectively, these defensive implications highlight the need for a multi-layered, adaptive, and cooperative strategy to effectively counter the complex and evolving threat of human-centric scams.

Key Takeaways

• Scams are Transnational Organized Crime: Modern scams have evolved far beyond simple fraud, becoming highly organized, cross-border criminal enterprises deeply intertwined with human trafficking and money laundering, posing significant economic and social threats.
• Multi-Pillar National Strategy is Essential: Effective defense requires a comprehensive approach encompassing robust national and international cooperation, agile operational responses, advanced technical countermeasures, and continuously updated legal frameworks.
• Rapid Response is Critical for Financial Fraud: Initiatives like Thailand's 24/7 Online Anti-Scam Center (AOC) and its "10-minute rule" for fraud reporting and account freezing are crucial for intercepting funds before they are fully laundered.
• Technical Intelligence and Hardening are Key: Reverse engineering malicious apps, penetrating C2 servers, enhancing biometric verification with random movements, and disabling remote access in banking applications provide vital intelligence and strengthen defenses against sophisticated attacks.
• Proactive Regulation Disrupts Attack Vectors: Implementing strict SIM card registration limits, requiring KYC for social media advertising, and mandating A2P SMS sender registration proactively close common avenues exploited by scammers.
• User Awareness Remains the First Line of Defense: Despite advanced technical and legal measures, continuous public education campaigns, especially targeting vulnerable populations, are fundamental to preventing initial victimization.

About the Speaker(s)

Major General Teerawut Wittayakorn serves with Thailand's National Cybersecurity Agency (NCSA). As a representative of a key national cybersecurity authority, his insights are grounded in the practical challenges and strategic responses to cyber threats at a governmental level.

Saichon Saelee is the Director of the Cyber Coordination Office at the NCSA. Her role involves orchestrating efforts across various agencies and sectors to combat cybercrime, providing a perspective on the operational and collaborative aspects of national cybersecurity defense. Together, their expertise represents Thailand's concerted efforts to understand and counter the pervasive problem of online scams.