Your Thai bank still texts you a code. The central bank wants that to stop

If you use a Thai banking app, you still get a one-time code by SMS before many transfers. The Bank of Thailand's revised draft Digital Channel Security rules would stop that for the riskiest moves, and the public comment window closes today, 6 November 2026. The draft is not law yet, and the final text can still change.

What the draft would ban

The October 2026 draft says providers must stop using OTP codes sent by SMS or email as an authentication factor for transfers, cash withdrawals, loan and credit-card drawdowns, cash collected at ATMs, and increases to transfer limits. The aim, in the Bank's own words, is to cut OTP interception and SIM-swap fraud. SMS can still be used for alerts after a transaction.

Allowed replacements listed in the draft include an OTP generated inside a pre-registered app, a passkey tied to your device, and hardware or software tokens. Put simply, the second factor has to come from something already bound to you, not a text message anyone with a new SIM could intercept.

Face checks for larger transfers

For mobile apps, the draft also requires face comparison with presentation-attack detection for high-value moves. At minimum that covers a single transfer of 50,000 baht or more, each time daily transfers reach another 200,000 baht, and any increase of 50,000 baht or more to a daily transfer limit, with limited exemptions where face comparison is not practical.

Who would have to comply

Coverage is wider than the 2025 Mobile Banking Security notices. The draft reaches financial institutions, specialised financial institutions, e-money providers, credit-card providers, and supervised personal-loan and nano-finance lenders that offer digital channels, including internet banking as well as mobile apps.

When would it start

The draft's issue date is still blank in January 2027. If adopted as written, it would take effect 30 days after publication in the Royal Gazette, except for one authentication clause that would take effect after 90 days. Providers that cannot meet the timetable would need to apply for a case-by-case exemption within seven days of the effective date.

What remotes and expats should do now

• Keep using the official bank or e-wallet app from the App Store or Play Store, not sideloaded APKs.
• Turn on the bank's in-app notifications and treat unexpected SMS links as suspect.
• If you change phones, expect a cooling-off period or lower limits just after the move, which the draft encourages.
• Older or rooted phones may face tighter caps: the draft lets providers restrict risky operating systems, including caps as low as 5,000 baht a day to your own accounts in some cases.
• Submit comments on the Bank of Thailand hearing page before the window closes today if the rules affect how you run a business account.

Why the Bank is rewriting the rules

Thailand's earlier Mobile Banking Security rules cut 'money-draining app' fraud. Fraudsters then shifted toward non-bank apps and internet banking, including malware that steals passwords and SMS OTPs. The revised draft, released for a second hearing on 7 October 2026 after a July round, is the Bank's answer to that shift.