Online Fraud: Account Freezing & Recovery in Thailand

The first hour after the scam: freezing accounts under the emergency decree

The emergency decree on technology-crime suppression lets banks freeze a transaction the moment they receive a report from the victim or a relevant authority, without waiting for a court order at that first stage. It is the fastest channel Thai law currently offers for money that has just moved. But timing dominates every other variable, because the receiving account is rarely where the money settles — scammers typically push it onward within minutes to hours to shake it loose from an easy trail.

What we do at once is call the originating bank's hotline to request a temporary freeze, while simultaneously filing through the police's online reporting platform to obtain the case reference number the bank needs to sustain that freeze. Evidence to have ready in this window includes the transfer slip, screenshots of the conversation, the receiving account number, and a written timeline clear enough for an officer to grasp in a single sitting. Speed here directly determines whether the money is caught at the first mule account or has to be chased into a third or fourth hop, where recovery odds fall sharply.

One point we make clear from the outset: a temporary freeze is not a refund. It only stops money moving further inside the banking system so the legal process can catch up. If funds are already withdrawn as cash or converted into digital assets before the freeze lands, the chase changes shape entirely and takes far longer. We set realistic expectations from the very first conversation rather than offering false comfort while a client is still shaken.

Where and how to report so the file actually moves

Online fraud cases in Thailand now funnel through the Royal Thai Police's online reporting platform, built so a victim can lodge the essentials without first travelling to a station. Its strength is speed — a case reference issued quickly enough to support the bank freeze immediately. Its limit is that it is designed for opening the file; the actual statement-taking, evidence review, and deeper investigative work still require a follow-up meeting with the assigned investigating officer.

We always prepare the file for a client before that officer meeting, because these cases typically involve many victims scattered nationwide, and local officers need time to consolidate related files before the full network becomes visible. A submission that arrives with a clear timeline, evidence sorted into categories, and the applicable offences already flagged gets attention faster and stands a better chance of being linked into a larger network case with a bigger aggregate loss figure — which investigators tend to prioritise over a single small claim.

The charges typically run together — fraud under the Criminal Code alongside offences under the Computer-Related Crime Act covering false data input or deception carried out through a computer system. Naming both from the start helps the investigator issue subpoenas and request records from telecom providers or online platforms on the right footing, without losing time later re-drafting the file to add missing offences.

Mule accounts and tracing the money trail

Stolen money rarely sits in the real perpetrator's own account. It passes through mule accounts — accounts opened by third parties who were paid or tricked into handing over their passbook and ATM card to the operation. Tracing the trail therefore needs cooperation from several banks at once, because a single sum can be split into ten or twenty transfers scattered across multiple banks within a single day.

Our role is to work with the investigator to request transaction records from each receiving bank systematically, and to map the flow so it is clear where money went, which points are still inside the banking system and freezable, and which have already been cashed out and are effectively unrecoverable. Building that map early lets the investigator decide faster which accounts to seek a freeze order against first.

Some mule account holders are themselves victims of fake job schemes who opened accounts without knowing they would be used for laundering; others knew and were paid a cut of every sum that passed through. That distinction shapes both the recovery strategy and the account holder's own criminal exposure, so we always check the individual circumstances of each mule account rather than treating every receiving account as automatically culpable.

Common scam formats: romance, investment, and fake-parcel schemes

Romance scams build a relationship over weeks or months before money is ever mentioned. A common thread is the fraudster claiming to live abroad, holding a job requiring frequent travel, and manufacturing repeated urgent emergencies needing money fast. Victims in this category tend to send money in several instalments that add up to far more than they initially intended, since each individual request looks reasonable when considered on its own.

Investment scams lean on the credibility of a fake platform showing profits climbing daily on screen — numbers generated internally with no link to any real market. Victims are often allowed a genuine small withdrawal early on to build trust before being pushed into a much larger deposit. Fake-parcel scams typically open with a message or call claiming a parcel is held at customs or linked to a criminal case, then pressure the target into transferring money to clear their name or pay a fabricated fine.

All three share the same lever: urgency and shame used to force a fast decision before the target can think it through. Recognising the format early lets us pin down the right charges and evidence approach, since each type leaves different digital traces — investment scams usually leave a fake website or app whose domain registration can still be traced, while parcel scams typically use disposable SIM numbers requiring a separate records request to the mobile operator.

Tracing crypto transfers, and why they are harder than bank accounts

Once a scammer converts baht into digital assets through an exchange and moves them to an external wallet, the bank-freeze mechanism stops working, because a blockchain has no central authority to halt a transaction the way a bank can. What remains possible is following the transaction trail on-chain — public data anyone can view — but linking a wallet to a real person still depends chiefly on records from digital-asset exchanges registered inside Thailand.

Exchanges regulated by the Securities and Exchange Commission are required to hold identity-verification data under know-your-customer standards, so once funds are traced to a particular exchange's account, an investigator can request that data through a formal subpoena. But if the fraudster moves on to a wallet outside any domestic exchange, or converts through a foreign exchange that does not cooperate, the trail breaks and the odds of tracking it further drop sharply.

We tell clients plainly that crypto-linked cases have a materially lower success rate than cases where the money stays entirely inside the banking system. What can be done is to build the transaction trail as thoroughly as possible from day one, so that if the operation is ever caught and assets seized, a victim with a complete file ready to join as an injured party sits in the queue for a share without having to reconstruct evidence from scratch.

Joining as an injured party and the civil claim for restitution

In cases with many victims, police or prosecutors typically already pursue the criminal case against the offender in the state's name, but each victim retains the right to petition to join as an injured party, preserving a civil claim for damages inside the same proceeding. This saves time and cost compared to a separate civil suit, particularly once a suspect is arrested and holds assets that can later be attached.

In cases where the offender is clearly identified and holds traceable assets, a separate civil suit can sometimes serve better, since it opens the door to interim protective measures freezing the defendant's assets before judgment, preventing a transfer-away during trial. We assess each file individually on whether a suspect has already been arrested, whether real assets exist to attach, and how far the criminal case has progressed, to decide which route fits best.

One point to state plainly: even a judgment ordering full repayment only becomes real money if the defendant still holds assets. Many scam operators have already spent the proceeds by the time they are caught, or have hidden assets under someone else's name. A judgment is only the starting point for enforcement, which can run on for a long stretch afterward — it is not the moment money lands back in the victim's account.

Cross-border cases, and why hope must rest on realism

Many online scam operations run from outside Thailand — call centres along the border, or servers hosted in countries with limited legal cooperation with Thailand. Requesting mutual legal assistance runs through official government channels and can take months to years, with the outcome hinging largely on the destination country's willingness to cooperate — a variable entirely outside our control.

In practice, cross-border cases that actually move tend to be ones where Thai police coordinate with foreign counterparts through regional cooperation frameworks, which activate when a large operation affecting many victims at once is being dismantled. A single small-value claim rarely gets prioritised within those frameworks — which is why we often advise victims to combine forces with others hit by the same operation, raising the combined loss figure and the odds the case draws attention.

We do not promise recovery in cross-border cases, and do not advise clients to pour heavy spend into chasing a case where the deciding factors sit beyond any lawyer's control. What we do honestly is exhaust every channel available inside Thailand first — domestic account freezes, the criminal report, and joining as an injured party — so that if an arrest and asset seizure ever materialise, the client stands in the queue for a share without having to start over.

When to act, and when waiting is fine

• Call the bank and file the report the instant you realise it is a scam — do not wait to gather every piece of evidence first

  Extra documents can follow later; the minutes lost while waiting are money that may become unreachable.

• Combine forces with other victims once the same operation is confirmed

  A higher combined loss figure tends to draw more investigative priority than a lone claim, especially in cross-border cases.

• Prepare for delay once funds have already been converted into crypto

  We will trace what we can, but will not oversell the odds — success rates here are clearly lower than purely bank-based cases.

• File the petition to join as an injured party even before any arrest happens

  Holding standing in the file in advance means not starting from zero if assets are ever seized down the line.