The real risks, in proportion

The pattern is the same as in Britain: most fraud now targets you through your phone, not through a cash machine. The defences are simple, and almost all of them work whether you're in Bangkok, Phuket or Manchester.

The good news for UK cardholders is that the law is on your side. If someone uses your card fraudulently, your bank should refund you as long as you report it promptly and haven't been grossly negligent. The aim of everything below is to stop it happening at all — and, if it does, to limit how much leaves your account before you notice.

ATM skimming: how it works and how to spot it

A skimming attack needs two things: a copy of your card's details and your PIN. Criminals get the first with a device fitted over or inside the card slot, and the second with a tiny hidden camera or a fake keypad laid over the real one. They then make a counterfeit card and withdraw cash.

Before you insert your card, take five seconds to check the machine:

• The card slot. Does it stick out, feel loose, or look different from the machine next to it? Give it a gentle tug.
• The keypad. Is it raised, thick or spongy? Overlays sit on top of the real keys.
• Above the keypad. Look for a small hole, an odd strip or a leaflet holder that could hide a camera.
• Glue, tape or scratches around the slot or the fascia.
• A machine that looks different from others of the same bank nearby.
• Anything left on or near the machine — a phone, a "helpful" notice, a box.

If anything looks wrong, don't use the machine. Walk away, and if it's at a bank branch, tell the staff. Thai police have asked the public to report ATM irregularities.

Safe habits at the cash machine

1. Choose machines at bank branches or inside malls, in daylight where you can. If something goes wrong, the bank is right there.
2. Avoid lone kiosks on quiet streets and in nightlife areas late at night.
3. Check the slot and keypad before you insert your card.
4. Cover your PIN and be aware of anyone standing close behind you.
5. Don't accept help from strangers if the machine "isn't working".
6. Decline the conversion and choose baht — it isn't fraud, but it's the costliest mistake at Thai ATMs.
7. Wait for your card after the cash — Thai machines often return it second.
8. Put the cash away before you leave the machine, and check your app.

If the machine keeps your card and someone nearby offers to help you get it back by entering your PIN again, don't. "Card trapping" devices hold the card in the slot until you leave, then the thief retrieves it — having watched your PIN. Freeze the card in your app immediately and call your bank before you walk away.

Card payments in shops, bars and hotels

Card details can also be copied when you pay — by a tampered terminal, or by someone who takes your card out of sight. A few habits keep you safe:

• Keep your card in sight. Ask for the machine to be brought to you rather than letting your card disappear behind the bar.
• Pay contactless or by phone where you can — it never leaves your hand.
• Use a credit card at hotels and for anything where your details are taken away or kept on file.
• Check the amount and currency on the screen before you tap or enter your PIN.
• Keep receipts and check them against your app at the end of each day.
• Never let anyone photograph your card, front or back, "for the deposit".

Hotels and rental shops sometimes want a card on file for deposits. A credit card is better for this: if the details are misused, it's the lender's money at risk, not your current account. And avoid leaving your passport as a deposit for scooters or anything else.

Booking and hotel payment scams

This is the fastest-growing kind of fraud facing visitors to Thailand, and it doesn't involve your card being stolen at all — it persuades you to hand over the money yourself.

In April 2026, Thailand's Personal Data Protection Committee issued its top-level alert after Booking.com confirmed that unauthorised parties had accessed some customers' reservation details. Scammers used the real names, dates and hotel names to message guests on WhatsApp or in-app chat, posing as the hotel or Booking.com, claiming a problem with the payment card and threatening cancellation within 12 to 24 hours unless the guest paid through a link or into a personal bank account. Booking.com said financial information was not accessed.

The same month, Thai cyber police arrested a man in Chonburi accused of using a Pattaya hotel's customer database to set up fake websites and email accounts in the hotel's name, telling more than 35 former guests they had damaged their rooms and owed compensation. Victims paid around ฿100,000 in total before he was caught.

If you've already paid, contact your card provider immediately — a credit card gives you the strongest chance of getting money back — and report it to the Thai cyber police or the platform.

Fake bank calls, texts and fake QR codes

Fake bank contact. Criminals call, text or message pretending to be your bank's fraud team — often right after you've lost a card or your phone. They ask you to read out a one-time passcode, "confirm" your card details or move money to a "safe account". Your bank will never ask for your PIN, full password or a passcode, and never asks you to move money to keep it safe. Hang up and call back on the number in your app.

Fake QR codes. As Thai QR payments spread, so have doctored codes — a sticker placed over a shop's real QR code, sending your payment to a different account. If you pay QR codes through a tourist wallet, check the recipient's name shown on screen matches the business before you confirm, and be wary of codes that look stuck on top of another.

Public Wi-Fi. Banking apps use their own encryption, but hotel, café and airport Wi-Fi is shared with strangers. Using mobile data — or a reputable VPN on public networks — adds a layer of protection when you log in to your bank. If an app refuses to work over a VPN, switch it off and use mobile data.

Card security features that help in Thailand

Some UK cards make fraud much harder — or much less damaging. Features worth having for a trip to Thailand:

Features as described by each provider; check your own card's app settings before you travel.

If your card is used fraudulently

1. Freeze the card in your app immediately.
2. Screenshot the transactions you didn't make.
3. Report it to your bank in the app or on its overseas number, and ask for a new card.
4. Change your passwords if your phone or email may be involved.
5. Report it to the police. For theft, call the Tourist Police on 1155; online fraud can be reported to the Thai cyber police.
6. Tell your travel insurer if cash or belongings were also stolen.
7. Use your backup card while the bank investigates.
8. Keep checking your statements for a few weeks — fraud sometimes appears later.

Under UK rules, banks should refund unauthorised payments that you report promptly, unless you acted fraudulently or with gross negligence — such as writing your PIN on the card or sharing a passcode. If you authorised a payment because you were tricked, the rules are different, so tell your bank exactly what happened.

The safest cards to take to Thailand

A fee-free debit card with strong app controls, plus a fee-free credit card for anything where your details are taken or kept.

Set up your cards so fraud gets nothing

• Turn on instant notifications for every card, so you see every payment the moment it happens.
• Keep daily limits sensible — enough for ฿20,000 at once, not your bank's maximum.
• Use card controls to switch off online or ATM use on cards you don't need for that.
• Use a credit card for hotels, bookings and anything kept on file.
• Use a virtual or disposable card for online bookings where you can.
• Keep a backup card in the hotel safe, on a different network.
• Keep your UK number working or switch to app-based approval, so security codes reach you.
• Save your banks' overseas numbers on paper as well as your phone.

For people living in Thailand

Expats face the same risks plus a few more: Thai bank accounts and PromptPay are popular targets for scam calls in Thai and English, and money sent to the wrong account by bank transfer is very hard to recover. Keep your UK and Thai banking apps locked down, never transfer money because someone on the phone tells you to, and be especially careful with large transfers — for rent, property or investments — where a single fake invoice or changed bank detail can cost a fortune.

For significant sums, verify payment details by phone with someone you know, and plan large transfers properly rather than in a hurry.