The real risks, in proportion

The pattern is the same as in South Africa: most fraud now targets you through your phone, not through a cash machine. The defences are simple, and almost all of them work whether you're in Bangkok, Phuket or Sandton.

The key point on refunds: banks are responsible for fraudulent transactions that happen after you report a card lost, stolen or compromised. Before that — and if you were careless with your PIN, CVV or one-time PINs — you may not be reimbursed. The aim of everything below is to stop fraud happening at all, and if it does, to report it fast and limit how much leaves your account before you notice.

ATM skimming: how it works and how to spot it

A skimming attack needs two things: a copy of your card's details and your PIN. Criminals get the first with a device fitted over or inside the card slot, and the second with a tiny hidden camera or a fake keypad laid over the real one. They then make a counterfeit card and withdraw cash.

Before you insert your card, take five seconds to check the machine:

• The card slot. Does it stick out, feel loose, or look different from the machine next to it? Give it a gentle tug.
• The keypad. Is it raised, thick or spongy? Overlays sit on top of the real keys.
• Above the keypad. Look for a small hole, an odd strip or a leaflet holder that could hide a camera.
• Glue, tape or scratches around the slot or the fascia.
• A machine that looks different from others of the same bank nearby.
• Anything left on or near the machine — a phone, a "helpful" notice, a box.

If anything looks wrong, don't use the machine. Walk away, and if it's at a bank branch, tell the staff. Thai police have asked the public to report ATM irregularities.

Safe habits at the cash machine

1. Choose machines at bank branches or inside malls, in daylight where you can. If something goes wrong, the bank is right there.
2. Avoid lone kiosks on quiet streets and in nightlife areas late at night.
3. Check the slot and keypad before you insert your card.
4. Cover your PIN and be aware of anyone standing close behind you.
5. Don't accept help from strangers if the machine "isn't working".
6. Decline the conversion and choose baht — it isn't fraud, but it's the costliest mistake at Thai ATMs.
7. Wait for your card after the cash — Thai machines often return it second.
8. Put the cash away before you leave the machine, and check your app.

If the machine keeps your card and someone nearby offers to help you get it back by entering your PIN again, don't. "Card trapping" devices hold the card in the slot until you leave, then the thief retrieves it — having watched your PIN. It's the same trick used at South African ATMs. Stop the card in your app immediately and call your bank before you walk away.

Card payments in shops, bars and hotels

Card details can also be copied when you pay — by a tampered terminal, or by someone who takes your card out of sight. Keep your card where you can see it, and ask for the machine to be brought to you rather than letting your card disappear behind the bar. Paying contactless or by phone means the card never leaves your hand, and a credit card is the better choice at hotels and anywhere your details are taken away or kept on file. Check the amount and currency on the screen before you tap or enter your PIN, keep your receipts and check them against your app at the end of each day, and never let anyone photograph your card, front or back, “for the deposit”.

Hotels and rental shops sometimes want a card on file for deposits. A credit card is better for this: if the details are misused, it's the lender's money at risk, not your transactional account. And avoid leaving your passport as a deposit for scooters or anything else.

Booking and hotel payment scams

This is the fastest-growing kind of fraud facing visitors to Thailand, and it doesn't involve your card being stolen at all — it persuades you to hand over the money yourself.

In April 2026, Thailand's Personal Data Protection Committee issued its top-level alert after Booking.com confirmed that unauthorised parties had accessed some customers' reservation details. Scammers used the real names, dates and hotel names to message guests on WhatsApp or in-app chat, posing as the hotel or Booking.com, claiming a problem with the payment card and threatening cancellation within 12 to 24 hours unless the guest paid through a link or into a personal bank account. Booking.com said financial information was not accessed.

The same month, Thai cyber police arrested a man in Chonburi accused of using a Pattaya hotel's customer database to set up fake websites and email accounts in the hotel's name, telling more than 35 former guests they had damaged their rooms and owed compensation. Victims paid around ฿100,000 in total before he was caught.

If you've already paid by card, contact your bank immediately and ask it to dispute the payment — a credit card gives you the strongest position. Report it to the Thai cyber police or the platform as well.

Fake bank calls, SMSes and fake QR codes

Fake bank contact. Criminals call, SMS or WhatsApp you pretending to be your bank's fraud team — often right after you've lost a card or your phone. They ask you to read out a one-time PIN, approve a notification in your banking app, "confirm" your card details or move money to a "safe account". Your bank will never ask for your PIN, password or one-time PIN, and never asks you to move money to keep it safe. Hang up and call back on the international number in your app.

Fake QR codes. As Thai QR payments spread, so have doctored codes — a sticker placed over a shop's real QR code, sending your payment to a different account. If you pay QR codes through a tourist wallet, check the recipient's name shown on screen matches the business before you confirm, and be wary of codes that look stuck on top of another.

Public Wi-Fi. Banking apps use their own encryption, but hotel, café and airport Wi-Fi is shared with strangers. Using mobile data — or a reputable VPN on public networks — adds a layer of protection when you log in to your bank. If an app refuses to work over a VPN, switch it off and use mobile data.

Card security features that help in Thailand

Some South African cards make fraud much harder — or much less damaging. Features worth using on a trip to Thailand:

Features as described by each provider; check your own card's app settings before you travel.

If your card is used fraudulently

If you're defrauded, stop the card in your app immediately and screenshot the transactions you didn't make. Report it to your bank in the app or on its international (+27) number and ask it to dispute the transactions, and change your passwords if your phone or email may be involved. Report it to the police too: for theft, call the Tourist Police on 1155, and online fraud can be reported to the Thai cyber police; your bank may also ask for a SAPS case number when you're home. Tell your travel insurer if cash or belongings were also stolen, use your backup card while the bank investigates, and keep checking your statements for a few weeks — if your ID was taken too, consider asking a credit bureau for a credit freeze.

Reported fraud goes to your bank's disputes team, which investigates and tells you the outcome. Banks are responsible for fraudulent transactions after you've reported a card, but if you were negligent with your PIN or CVV, your money might not be reimbursed. If you authorised a payment because you were tricked, banks treat it differently again — so tell your bank exactly what happened.

The safest cards to take to Thailand

A low-fee debit card with strong app controls, a credit card for anything where your details are taken or kept, and a backup from a second bank.

Set up your cards so fraud gets nothing

Before you travel, turn on instant notifications for every card, so you see every payment the moment it happens, and keep daily limits sensible — enough for ฿20,000 at once (about R10,000), not more, raising them temporarily when you need to. Switch on international use only for the cards you're taking, and switch it off again when you're home. Use a credit card for hotels, bookings and anything kept on file, and a virtual card for online bookings where you can. Keep a backup card in the hotel safe, from a different bank on a different network. Make sure one-time PINs will reach you, either by keeping roaming on for SMS on your South African number or by switching to app-based approval, and save your banks' international numbers on paper as well as on your phone.

For people living in Thailand

Expats face the same risks plus a few more: Thai bank accounts and PromptPay are popular targets for scam calls in Thai and English, and money sent to the wrong account by bank transfer is very hard to recover. Keep your South African and Thai banking apps locked down, never transfer money because someone on the phone tells you to, and be especially careful with large transfers — for rent, property or investments — where a single fake invoice or changed bank detail can cost a fortune.

For significant sums, verify payment details by phone with someone you know, and plan large transfers properly rather than in a hurry.