Chapter 12 — Thailand

Everything in this book has been general. This chapter is not.

Thailand is where the reader of this book will work, and it is not a small version of the countries the preceding chapters drew their evidence from. The apparatus is different, the scale is different, the criminals are mostly not in the country, and the measurements — as the second chapter promised — mean something different again.

The volume

In the first 120 days of 2026, Thailand's Anti Cyber Scam Center recorded 121,921 online crime cases and THB 7.48 billion in losses. [ESTABLISHED] (ACSC, announced 11 May 2026 by Pol. Gen. Thana Chuwong)

That is roughly a thousand new cases a day, and the composition matters more than the total. Goods and services fraud is most of the cases — 85,215 of the 121,921, averaging THB 15,727 each. Investment fraud is most of the money — 80.2% of all losses, averaging THB 166,449 per case. [ESTABLISHED]

A system optimised for case count and a system optimised for baht recovered would pursue entirely different criminals. That is a policy choice nobody has to state out loud, because whichever number gets reported upward makes it silently.

Two other figures, with their windows attached:

[ESTABLISHED] for both. And the caution this book insisted on: the sources do not agree with each other on totals. The ACSC figure implies about THB 62 million lost per day; a March 2026 report citing police put it at 70 million. Full-year 2025 appears as both THB 115.3 billion and roughly THB 89 billion for January to November. [CONTESTED]

Case counts agree tolerably across sources at roughly a thousand a day. Loss totals do not. If you must quote one number, quote a case count with its window.

What that thousand a day actually is

Now apply the second chapter to it.

A recorded-crime figure measures reporting behaviour. In England and Wales, with a mature statistical system and a dedicated national fraud reporting centre, the recorded series captured about seven per cent of estimated fraud incidents. What does Thailand capture?

Nobody publishes an answer. But there is a survey that lets us bound it, and the arithmetic is worth doing carefully in the open.

The Global Anti-Scam Alliance's 2025 survey found that 72% of Thai adults encountered scam attempts, 60% were scammed in the preceding twelve months, and 14% lost money, at an average of USD 408 per victim. [ESTABLISHED] as survey output (GASA, via Kyoto Review)

Take the 14%. Thailand's adult population is on the order of 57 million. Fourteen per cent of that is roughly eight million people losing money to scams in a year. Reported cases run at about 121,921 per 120 days, which annualises to roughly 370,000.

That is a capture rate on the order of five per cent — startlingly close to the English seven.

Now the honesty this book owes you, because a derived number is the easiest kind to be wrong with. This calculation rests on four things I did not verify: that the survey sample generalises to the adult population, that "scammed and lost money" in a survey means the same event as a filed case, that one victim generates one case, and my approximate population denominator. Any of them could move the answer by a factor of two. [CONTESTED] — it is my arithmetic on someone else's survey, and I am showing the working so you can break it rather than presenting a number you would have to trust.

What survives even a generous treatment of those four objections is the order of magnitude: the reported caseload is a single-digit percentage of what happened. The system is not overwhelmed by the crime. It is overwhelmed by the small visible fraction of the crime.

There is a second implication, harder and worth stating. If reporting were to improve — a successful public campaign, an easier app, one viral story about money actually being returned — the recorded figures would rise steeply, and every dashboard in the country would show a catastrophe. The apparatus is not currently built to distinguish more crime from more reporting. Nor is anyone else's.

The machinery, which is real

It would be false to describe Thailand as defenceless. The counter-fraud structure built since 2023 is substantial, and by the government's own reporting it has moved real numbers.

The Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566, effective 17 March 2023, created the legal structure behind AOC 1441. Its 2025 amendment, effective 13 April 2025, went considerably further: it made banks, telecommunications operators and digital-asset businesses jointly liable for damages arising from crimes committed through their platforms where specified duties are unmet. [ESTABLISHED] (Royal Gazette text; iLaw)

In my judgement that amendment is the most consequential item in this chapter — more consequential than any investigative technique in this book. It converts a policing problem into a business-risk problem for organisations with vastly more staff, money and data than the police have. Enforcement scales badly; liability scales by itself.

Downstream sits the Central Fraud Registry: a shared interbank database in which flagging a person at one bank suspends their accounts at every bank and blocks new account opening. [ESTABLISHED] (Nation Thailand)

That is entity resolution in national production — the mathematics of the linking chapter, deployed, today, on Thai financial records. It also has precisely the harm profile this book warned about: a system that acts on a flag, at national scale, in a domain where — as noted earlier — no independently verified wrongful-outcome case has ever been documented, largely because that harm produces no court record.

Alongside it: a SIM registration limit of five per person at physical service centres with SIM-box devices outlawed; a cash rule requiring declared source of funds for deposits above THB 5 million from October 2026; and, effective 12 August 2026, a ministerial regulation letting victims request refunds through the anti-money-laundering office without a court order. [ESTABLISHED]

That last one deserves attention out of proportion to its coverage. It shortens the distance between a report and money coming back, which is the only outcome most victims actually want. It will do more for reporting rates than any campaign — and, per the section above, it will therefore also make the statistics look worse.

The reported enforcement results, October 2025 to June 2026: 351,000-plus mule accounts closed, THB 3.6 billion frozen, more than 29,000 suspects arrested, warrants for over 70 ringleaders; personal mule accounts down 76.9% and corporate down 88.4%. [CLAIMED] — a government describing its own performance, with no independent audit that I could find. (Xinhua, 13 Jul 2026; Nation Thailand, 13 Jun 2026)

The three silences

Three things are not published, and each is load-bearing for anyone who wants to help.

No clearance rate for online fraud. [ABSENT] I searched in Thai and English through police, ACSC, AOC and ministry channels. What exists is general and non-cyber: Bangkok's Metropolitan Police Bureau reported nearly 90% case clearance for 2025 across 76,744 recorded criminal cases. That is not a cyber-fraud number and substituting it would be a misrepresentation — and in any case the preceding chapters established that clearance rates are not comparable even between countries that publish them, let alone between offence types within one.

No aggregate conviction count or rate. [ABSENT] The record holds statutory penalties — up to three years and THB 300,000 for selling or renting an account, two to five years for recruiting mules — and isolated sentencings, such as eight people including four bank employees jailed over a network that took more than THB 100 million. It holds no total. Arrests are published; outcomes are not.

No current investigator headcount, and no published statement of backlog. [ABSENT] The most recent figure I could locate is 333 officers, October 2020, at CCIB's founding, accompanied by the bureau's own description of itself as understaffed. AOC's hotline capacity is published — 100 lines, 24 hours, roughly ten minutes to freeze a flagged account — but that is triage throughput, not investigative capacity, and treating one as the other is the easiest mistake available here.

Put the three together with the five per cent above, and the shape of the problem is visible. A single-digit fraction of a very large crime arrives as a thousand daily reports. Arrests are counted. Convictions are not. Capacity is not. Clearance is not.

The consequence is uncomfortable and it applies to your proposal as much as to anyone else's: nobody can currently demonstrate that any intervention improves outcomes, including the interventions already running. Where the denominator is unpublished, improvement in it is unprovable.

The criminals are not in Thailand

One more thing distinguishes this landscape from the American and British material the earlier chapters rest on.

Estimates put the regional cyber-fraud workforce across Cambodia, Myanmar and Laos above 350,000 people, with syndicate revenue estimated at USD 50–75 billion annually. [CLAIMED] — analyst estimates with no stated method, and I would not repeat them in a room without saying so. (AIIA)

What is better established: roughly 260 workers from 19 countries were freed from Myawaddy compounds in February 2025 and handed to Thai authorities [ESTABLISHED] (IJM), and more than 5,300 people were still held in scam centres near the Thai border as of 23 June 2026 [ESTABLISHED] (Al Jazeera).

Thailand's response has included cutting electricity, internet and fuel supply into Myanmar border areas and military deployment against illegal crossings. [ESTABLISHED] (USIP)

Two things follow. The first is that a thousand Thai complaints a day are the exhaust of an industrial operation staffed substantially by people who are themselves trafficked — which changes what "catching the criminal" means and puts a genuine ethical weight on any tool built here.

The second is structural. Investigation ends at a border. A perfectly identified network in a compound outside Myawaddy converts into an arrest only through diplomacy, cross-border operations, or the money — which is why the financial track in this book is not merely one approach among several in the Thai context. It is frequently the only one that reaches.

Where the work actually is

Everything above narrows to a single opening, and it is narrow deliberately.

The Central Fraud Registry links accounts. That layer exists, it is national, and it works. The DES ministry has reportedly budgeted THB 200 million for a centralised AI data-management system for AOC, targeted at Q3 2026. [CLAIMED] — reported at summary level, primary document not obtained. (Siam Legal)

Assume, correctly, that procurement is already in motion and that the account-number layer is covered.

What is not covered is the narrative. Every complaint contains a victim's own account of what happened: who contacted them, what they were told, which platform, what the promise was, what the script sounded like. That text is the only record of the human operation behind the accounts, and it sits in prose that no database query can reach. It is in Thai. It is the layer the linking chapter's mathematics was built for and the layer nobody has built.

That is not a claim to a gap nobody noticed. It is a claim that the gap is language-shaped, and that being able to read Thai at scale is a real and currently scarce qualification.

Two constraints on anyone who takes it up, both established earlier in this book and both sharper here. The system must produce pointers, never assertions — case numbers with quoted text a person opens and checks. And it must run where the data already sits, because the material is victim testimony and the lawful basis for processing it — under a PDPA whose application to individual investigators nobody has clarified — is the first question a lawyer will ask and the last one anybody has answered.

The Move — Convert every Thai figure into a rate before you use it. No Thai number in this chapter, or anywhere else, means anything until you have attached the period it covers, the body that issued it, and the denominator it sits on. Then, before comparing it to another country's figure, ask the three questions the second chapter established: is the offence defined the same way, is it counted the same way, and do victims report at the same rate? For Thailand against Britain or America the answer to the third is almost certainly no, and the size of that difference is unmeasured. Write the unmeasured part down rather than letting the comparison carry it silently.

What would change my mind: if the Royal Thai Police published a cyber-fraud clearance rate, a conviction total, and current CCIB investigator numbers, most of this chapter would need rewriting around real data rather than around three absences — and I would treat that publication as far better news than anything this book proposes. If a Thai victimisation survey were run on the model of the CSEW, the five-per-cent estimate above could be replaced by a measurement, and it should be.