The Thai Bankers' Association (TBA) has confirmed the security and stability of banks' mobile banking applications.
For transfers starting from 50,000 baht per transaction, up to 200,000 baht per day, users must still verify their identity by scanning their faces for each transaction.
The confirmation came after news on Wednesday of the arrest of a programmer who sold software that enables the transfer of money and the ability to unlock the facial recognition feature of the app, making it possible to transfer money using the software, bypassing the facial scan required for transactions exceeding 50,000 baht.
The Thailand Banking Sector Computer Emergency Response Team (TB-CERT) conducted system checks within the sector.
After the investigation, the TBA clarified the software cannot be used for general customer accounts because comprehensive account owner information is needed, including bank account number, national ID number, mobile phone SIM and the device used for mobile banking.
In addition, identity verification data such as a mobile banking personal identification number, one-time password (OTP) and facial scans are required.
"In the reported case, the scammer exploited the software to facilitate transfers from mule accounts or illegal deposit accounts, enabling them to access all the personal data of account owners and conduct fraudulent transactions," the TBA said in a statement.
The TBA affirmed that mobile banking users who want to transfer up to 50,000 baht per transaction and 200,000 baht per day need to identify themselves through a facial scan to comply with the Bank of Thailand's cybersecurity measures.
The association insisted that all mobile banking apps are highly secure and stable. Commercial banks prioritise user security and continuously invest in upgrading their systems, ensuring reliable and secure use of mobile banking, said the TBA.
The association said it collaborated with related parties including the government and companies to establish preventive measures and manage financial threats effectively.
Customers and the public should follow financial threat prevention guidelines to minimise the risk of falling victim to criminals, said the TBA. These guidelines include not downloading software from unofficial sources, not revealing banking passwords or OTPs to others, not scanning faces or verifying identity through unknown apps, not clicking links from suspicious text messages, and contacting the originating agency directly to verify any suspicious transactions.
If an unusual transaction is detected, customers are urged to contact their bank's call centre or branch immediately.
The central bank said biometric authentication is required for high-value mobile banking transactions as part of measures to protect consumers from cyber-risks, starting from June. A facial scan on mobile devices is needed for mobile money transfers of more than 50,000 baht per transaction to local or overseas accounts; transfers of more than 200,000 baht per day; and to raise the transfer limit above 50,000 baht per transaction.