Bank of Thailand draft would end SMS codes for transfers
The draft is not in force yet. If it passes, people using internet banking, credit cards and loan apps will see new identity checks, SMS links from providers will go, and some phones may lose normal transfers.
Jump to a section
Many people still wait for an OTP code by SMS when they transfer money, type it in, and the payment goes through. But if the Bank of Thailand's new draft rules pass, that kind of code could no longer be used to confirm a transfer.
The Bank of Thailand, or BOT, is taking public comments on its draft Digital Channel Security rules from 7 October to 6 November 2026. The draft is not in force, and its details can still change.
This is the problem the BOT is trying to solve. The full draft says 2025 rules already cover the mobile apps of banks and e-money firms, so scammers moved on to internet banking and to apps from providers that are not financial institutions.
A code that travels over the phone network is the weak point
The draft bans SMS and email OTP codes for key transactions.
Those are transfers, cash withdrawals, loan drawdowns, credit card drawdowns, cash collected at ATMs and transfer limit increases. The BOT said the aim is to stop OTP interception and fraud in which someone obtains a new SIM in your name.
Picture someone getting a new SIM for your number. The code your bank sends would then land on their phone instead of yours. This attack is known as a SIM swap.
The draft's alternatives include an OTP inside a pre-registered app, a passkey, which is a digital key tied to your device, and hardware or software tokens. Put simply, the code has to come from something in your own hand. SMS can still be used for alerts after a transaction.
If the draft passes, you will see these 5 things
The BOT wants providers to do at least the following.
- Face scans for big transfers: apps must compare your face for transfers of 50,000 baht or more, each time transfers reach another 200,000 baht in a day, and for daily limit increases of 50,000 baht or more.
- One user account, one phone: each service allows one user account on one phone, and just after you move phones a provider may set a lower limit or allow only low-risk transactions.
- No links in SMS and email: providers must leave links out unless you ask for one on a single occasion, and on social media they cannot post links that ask for passwords, OTP codes or ID card numbers.
- Apps may refuse to open: rooted or jailbroken phones cannot use the apps, and a finance app will not run while an app that controls the phone remotely or spies on the screen is active.
- Older phones may transfer less: if an operating system is rated risky, a provider may allow transfers only to your own accounts, or cap them at 5,000 baht a day.
The draft also has exceptions. People with visual impairments may skip the face scan if another way of lowering the risk is in place, and transfers between your own accounts or recurring transfers already confirmed once may be exempt too.
The rules would reach beyond banking apps
Tilleke & Gibbins, a law firm, reported that this is a second-round draft, revised from a first draft in July 2026.
The draft covers banks, specialised financial institutions, e-money, credit cards, supervised personal loans and supervised nanofinance. That means credit card apps and supervised loan apps would have to comply too.
If adopted as drafted, the rules take effect 30 days after publication in the Government Gazette, while multi-factor checks for cash withdrawals and drawdowns take effect after 90 days. The draft leaves its issue date blank in January 2027.
Providers that cannot comply in time can apply for an exemption within seven days of the rules taking effect. So banks may not change at the same time, and the draft does not set a date by which anyone must drop SMS.
What you can do before 6 November
There are 4 things you can do now without waiting for the rules.
- Send a comment: download the form from the BOT's consultation page by 6 November, and ask questions at tsd-techpolicy@bot.or.th.
- Check where you still rely on SMS: if your internet banking or credit card still sends OTP codes by SMS, ask your provider whether it offers an app or a passkey yet.
- Update your phone and finance apps: the draft has providers stop serving older app versions that may have flaws, and restrict phones on risky operating systems.
- Stop tapping links that claim to be from a bank: open the app or type the address yourself, because the BOT said links are a route scammers use to trick people out of data and install malware.
FAQ
Do SMS OTP codes still work now?
They still work wherever your bank offers them. This is only a draft open for comment until 6 November 2026, and it is not in force.
What if I can't do a face scan?
The draft lets providers make exceptions where someone has trouble with the technology, such as people with visual impairments, as long as another way of lowering the risk is in place. Ask your provider.
Will I need a face scan for small transfers?
Under the draft, face scans start at 50,000 baht a transfer, or each time transfers reach another 200,000 baht in a day. Providers can be stricter, because these are minimums.
