SIM Swap Fraud in Thailand: How Attackers Drain Your Bank Through AIS, TRUE, and DTAC

SIM swap fraud is one of the most devastating cyberattacks targeting Thai consumers. Unlike ফিশিং, which requires you to click a link or share information, a SIM swap can happen without any action on your part. The attacker convinces your mobile carrier to transfer your phone number to a new SIM card — and suddenly, they receive every call, SMS, and OTP code meant for you.

In Thailand, where mobile banking and e-wallets depend heavily on SMS-based OTP ভেরিফিকেশন, a successful SIM swap can empty bank accounts in minutes.

The SIM Swap Attack Chain

Understanding the full attack chain helps you spot and stop it at any stage.

Stage 1: Information Gathering

The attacker collects আপনার ব্যক্তিগত তথ্য through:

• Social media profiles (name, birthday, phone number)
• Data breaches (leaked databases sold on dark web)
• ফিশিং attacks (fake forms that collect your ID number)
• Physical observation (looking over your shoulder at a carrier store)

Stage 2: The SIM Swap

Armed with your personal details, the attacker approaches a carrier store or calls customer service. They claim to be you and request a SIM replacement, citing a "lost" or "damaged" phone. In some cases, corrupt carrier employees facilitate the swap for a bribe.

Stage 3: OTP Interception

Once the new SIM is activated, your phone loses all signal. The attacker now receives:

• All SMS messages, including banking OTPs
• Phone calls, including bank ভেরিফিকেশন callbacks
• Password reset codes for email, social media, and apps

Stage 4: Account Takeover and Drain

The attacker moves quickly:

1. Resets your mobile banking password using SMS OTP
2. Logs into SCB EASY, K PLUS, Bualuang, or other banking apps
3. Transfers money to mule accounts via PromptPay
4. Drains your TrueMoney Wallet, Rabbit LINE Pay, or other e-wallets
5. Changes passwords on your email and social media to lock you out

Total time from SIM swap to empty accounts: often under 15 minutes.

Attack Chain Timeline

Stage	What Happens	Time	Your Warning Sign
1. Info Gathering	Attacker collects your data	Days-weeks	None (silent)
2. SIM Swap (สวอปซิม)	Your number moves to new SIM	5-30 minutes	Phone loses signal suddenly
3. OTP Capture	Attacker receives your OTPs	Immediate	You stop receiving SMS
4. Bank Drain	Money transferred out	5-15 minutes	Bank notifications (if email)
5. Lockout	Passwords changed on all accounts	10-30 minutes	Cannot log in anywhere

Carrier-Specific সুরক্ষা Steps

AIS (1175)

1. Set a SIM lock PIN — Visit any AIS shop to set a PIN required for SIM changes
2. Enable AIS Secure — Additional identity ভেরিফিকেশন for account changes
3. Register biometric ভেরিফিকেশন — Visit an AIS flagship store to add fingerprint ভেরিফিকেশন
4. Limit self-service changes — Request that SIM swaps require in-person ID ভেরিফিকেশন only
5. Monitor your AIS account — Check myAIS app regularly for unusual activity

TRUE (1242)

1. Set a SIM change PIN — Request a specific PIN for SIM replacement at any TRUE store
2. Enable TrueID ভেরিফিকেশন — Link your TrueID account for additional security
3. Request in-person only SIM swaps — Ask TRUE to flag your account so swaps require physical presence
4. Register your SIM with current ID — Ensure your registration details are up to date
5. Enable TRUE account notifications — Get alerts for any account changes

DTAC (1678)

1. Set a security PIN — Visit a DTAC center to establish a PIN for SIM changes
2. Request enhanced ভেরিফিকেশন — Ask for additional ID requirements for any SIM operations
3. Keep your account details updated — Outdated information makes social engineering easier
4. Monitor through dtac app — Check for unauthorized changes regularly
5. Enable alerts — Turn on notifications for account modifications

কী করবেন If You Suspect a SIM Swap

The moment your phone unexpectedly loses signal (not from being in a basement or dead zone), act immediately:

1. Use another phone to call your carrier — AIS: 1175, TRUE: 1242, DTAC: 1678
2. Ask if a SIM swap was requested — If yes, demand immediate reversal
3. Call your banks — Freeze all accounts linked to your phone number
4. Change all passwords — Email, banking, social media (from a different device)
5. Alert TrueMoney, Rabbit LINE Pay and any other e-wallets
6. File a police report — thaipoliceonline.com or local station
7. Call 1441 — Anti-অনলাইন স্ক্যাম Operation Center

Protect Your Recovery Information

Your phone number is a single point of failure for most account security. When আপনাকে করতে হবে store backup রিকভারি কোড, alternative contact numbers, or emergency access information, do not keep them in LINE chats or phone notes that disappear with your SIM. Use LOCK.PUB to create এনক্রিপ্টেড, পাসওয়ার্ড-সুরক্ষিত memos that আপনি পারেন access from any device. Store your 2FA ব্যাকআপ কোড, recovery emails, and emergency contacts in a secure memo that only আপনি পারেন unlock.

Advanced সুরক্ষা Against SIM Swap

Reduce SMS Dependency

• Use app-based 2FA (Google Authenticator, Microsoft Authenticator) instead of SMS OTP where possible
• Enable push notifications from banking apps as an alternative ভেরিফিকেশন method
• Set up email-based alerts as a backup notification channel

Limit Your Exposure

• Do not post your phone number on social media or public forums
• Use a separate phone number for banking and financial services
• Be cautious with caller ID — Scammers can spoof any number
• Shred documents containing your phone number and carrier details

Monitor Continuously

• Check your carrier account weekly for unauthorized changes
• Test your phone signal if you know you are in good coverage and it drops
• Set up bank transaction alerts via email (not just SMS)
• Review your credit report at the National Credit Bureau periodically

The Bottom Line

SIM swap fraud is particularly dangerous because it exploits a weakness in the telecom system, not in your behavior. The best defense is proactive: set SIM change PINs with your carrier, reduce dependence on SMS-based OTP, and act within minutes if your phone loses signal unexpectedly.

For storing critical recovery information সুরক্ষিতভাবে, visit LOCK.PUB to create free এনক্রিপ্টেড memos that only আপনি পারেন access with a password.