Thai bank officer nabbed for selling customer data in Nonthaburi

A Thai bank loan officer has been arrested for selling the personal data of over 5,000 customers, a lucrative side business that netted him tens of thousands of baht per month for over the past two years. The capture took place at 11am today, at the Technology Crime Suppression Division in Mueang Thong Thani.

The digital economy and society minister, along with the secretary-general of the Personal Data Protection Committee and the chief of the Technology Crime Suppression Division, announced the arrest of Suwan, whose last name has been withheld, aged 42. He was apprehended outside his residence in Bang Mae Nang, Bang Yai district, Nonthaburi Province, reported KhaoSod.

Suwan, a financial institution’s loan officer, had been secretly modifying and selling the institution’s customer data. The buyers were typically loan agents and insurance brokers but some data also fell into the hands of criminal groups, including call centre scams.

The police charged Suwan with several crimes, including fraud by impersonation, dishonest intent, deception, and entering false information into computer systems, leading to potential harm to others or the public. This arrest follows an extended investigation into violations of the Personal Data Protection Act (PDPA), which prohibits the unauthorized sale of personal information.

During the raid, authorities seized laptops and mobile phones containing customer data files. Suwan, as head of the loan department, had access to and stored part of this customer data, which he recorded, documented, and then sold to brokers from other financial institutions without following legal data protection procedures. He incrementally sold 3,000 to 5,000 high-credit customer names at one baht each, boosting his monthly income by several tens of thousands of baht.

The current scam tactics involve buying premium data—information on victims with good credit—from dark market groups. This allows scammers to build trust with victims more easily, as they possess specific, targeted information that approaches seem legitimate, leading to substantial financial losses. These breaches often originate from financial institutions, prompting the government to intensify crackdowns and pursue those involved in such criminal activities.

In coordination with the Personal Data Protection Office, the investigative team expanded their efforts to identify and take action against all individuals connected to PDPA violations. This includes administrative measures against units or institutions where data breaches occurred to ensure the protection of the public’s personal information.

In related news, a former insurance employee was arrested for illegally selling client data to criminal groups. Police seized evidence and charged him with unauthorized access to personal information. He confessed to earning income during the pandemic.