Thai Android users lose money in ThaID app scam orchestrated via SMS

In an emerging threat to privacy and finances, Android smartphone users in Thailand are being entangled in a sophisticated cyber scam. Orchestrated through the pretence of updating the mobile app ThaID, the scammers acquire remote control of the victim’s phones, enabling them to steal funds. The Department of Provincial Administration (DPA) notified the Cyber Crime Investigation Bureau (CCIB) of this alarming situation as numerous individuals have reportedly fallen prey to this ThaID app scam deception.

ThaID is a mobile app, supervised by the DPA, that permits Thai citizens to replace their physical ID with a digital version. This facilitates access to government services and lets them prove their identity during specific scenarios, such as air travel. The CCIB spokesperson, Police Colonel Kissana Phathanacharoen, offered an insight into the deception tactics.

According to Kissana, all victims received an SMS prompting them to access a contrived ThaID official Line account. The victims were duped into thinking that they were conversing with authorised DPA personnel. It was during these interactions that they were tricked into divulging personal data and their six-digit phone codes for their Internet banking applications. The victims were further instructed to install an APK file, allowing the fraudsters to gain remote control over their phones.

With this gain in control, the scammers managed to transfer money out of the victim’s bank accounts. Fraudulent activities such as these see constant evolution, as noted by Kissana. Previously, these digital pirates masqueraded as key personnel from various governmental organisations and businesses. Some of these included the Revenue Department, Department of Special Investigation, Department of Lands, Provincial Electricity Authority, Provincial Waterworks Authority, Thai Lion Air and Thai Life Insurance.

In light of the ThaID app scam, the CCIB urges individuals to be vigilant with links received via SMS. Providing a word of caution, Kissana stated that the DPA currently does not have an official Line account and has no policy of sending SMS messages to people, reported Bangkok Post.