Key Takeaways:
- Scammers instantly exploited Thailand’s Thais Help Thais Plus scheme with fake SMS and app links.
- Fake apps keep reappearing after takedowns, outpacing reactive security measures.
- Mobile security now requires vetting apps before install, not just blocking known threats.
Scammers in Thailand were targeting potential enrollees in the government’s Thais Help Thais Plus 60/40 scheme by sending fake SMS messages and chat app alerts designed to steal personal data. The fraud began almost immediately after public registration opened last week, with fraudsters impersonating Krungthai Bank and government agencies to trick residents into handing over sensitive information.
What Is the Thais Help Thais Plus Scheme?
The Thais Help Thais Plus (or Khon Thai Chuay Khon Thai Plus) 60/40 program is a government cost-sharing initiative, administered through Krungthai Bank, that offers eligible participants financial support on qualifying purchases. Registration for the general public opened on 25 May 2026, with a window running from 6am to 10pm daily until 29 May — or until the quota of 30 million rights is filled, whichever comes first.
Eligible participants were required to register through one channel only: the Paotang application.
The Scam: Urgency, Fake Links, and Identity Theft
Almost immediately after registration opened, fake SMS messages and chat app notifications began circulating, impersonating official government and bank communications. The messages share a common playbook:
- Create panic: Messages warn that registration spots are nearly full, pressuring recipients to act immediately.
- Redirect to fake pages: A link is provided leading to a fraudulent website that mimics the official registration portal.
- Harvest personal data: Victims are prompted to enter national ID numbers, dates of birth, banking credentials, PINs, or one-time passwords (OTPs).
- Push malicious app installs: In more serious cases, victims are directed to download fake applications capable of draining bank accounts.
Some scam messages instruct recipients to add a personal LINE account — a chat platform widely used in Thailand — for “assistance” with registration. This is a red flag. Krungthai Bank has explicitly stated it does not contact customers first and does not offer registration services through LINE or external links.
Fake Apps Are Still Slipping Through
Third-party app marketplaces do not sufficiently verify whether applications are legitimate or fraudulent. Fake apps continue reappearing even after takedowns, creating a cycle where attackers can rapidly relaunch malicious versions of financial, messaging, or commercial applications.
This is not an isolated problem. Attackers routinely exploit several common vectors:
- Repackaged legitimate apps that contain hidden malicious code
- Trojanized APKs distributed through unofficial channels
- Fake banking and payment apps designed to mimic trusted brands
- Apps bundling hidden malware or spyware alongside legitimate features
- Third-party SDKs with risky or undisclosed data collection behavior
- Mobile apps that leak sensitive user data through insecure storage or transmission
Even official app stores are not immune. While official marketplaces have stronger protections than alternative stores, they still account for a significant percentage of unwanted or malicious app installations.
Mobile Security is Becoming an App Security Problem
Mobile devices are now primary platforms for banking, healthcare, government services, communication, and critical business operations. As a result, attackers increasingly focus on compromising the mobile application layer itself.
Thailand’s experience reflects a broader global trend:
- Mobile fraud is accelerating
- Fake apps are becoming harder to distinguish
- Users remain vulnerable to social engineering
- App ecosystems continue growing faster than manual oversight
- Regulatory responses alone cannot keep pace
Security teams that continue treating mobile threats purely as device threats will struggle to keep up. Modern mobile security requires continuous visibility into the applications themselves.
Mobile App Vetting Addresses the Real Attack Surface
Instead of waiting for malicious behavior to trigger an alert on a device, organizations increasingly need to evaluate applications before they are trusted.
That means analyzing:
- App permissions
- Embedded trackers and SDKs
- Data leakage risks
- Hardcoded secrets and credentials
- Unsafe network communications
- Known vulnerable components
- Malicious or suspicious behaviors
- Compliance violations
- Software supply chain exposure
This is where Mobile App Vetting becomes significantly more valuable than purely reactive detection approaches.
The Thais Help Thais Plus 60/40 scheme scammers demonstrate that simply blocking known malicious infrastructure is not enough. Fraudulent apps continue appearing faster than reactive systems can respond. Organizations need visibility into what applications are actually doing before users install them or enterprise data is exposed. Contact us to learn how Quokka Q-scout can protect your organization from mobile app threats.
