Where the money went

By July 2026, Thailand’s banks had suspended 4,301,293 accounts as mule accounts, on the central bank’s count. More than half were in the two categories that need neither a victim’s police report nor an anti-money-laundering listing.

A mule account, บัญชีม้า, is a bank or e-money account opened or lent so that someone else can move money through it. Since 17 March 2023 that has been a crime. But the crime is not what suspended most of those accounts.

What the law says

The 2023 emergency decree gives its own reason in its preamble: people defrauded through technology were losing money, and the fraudsters were passing it through other people’s deposit accounts, electronic cards and e-money accounts, one after another, to hide it.

It then creates three offences:

• Section 9, the account holder. A person who opens, or lets someone else use, their own deposit account, electronic card or e-money account, without intending to use it for themselves or a business they are involved in, or lets someone use their mobile number, in circumstances where they know or should know it will be used for a technology crime or any other criminal offence. Up to three years, ฿300,000, or both.
• Section 10, the broker. A person who arranges, advertises or spreads word of the buying, selling, renting or lending of such accounts for crime. Two to five years and ฿200,000 to ฿500,000, or both.
• Section 11, mobile numbers. A person who arranges or advertises the buying or selling of mobile numbers registered in one person’s name whose actual user cannot be identified. Two to five years and ฿200,000 to ฿500,000, or both.

The broker’s offence has a two-year minimum. The holder’s has none. The law does reach further up the chain than the holder.

The 2025 amending decree, in force from 13 April 2025, left section 9 as it was and added:

• an offence for buyers and sellers of SIM numbers who register them incorrectly or incompletely, knowing or when they should know the number will be used for technology crime (up to one year, ฿100,000);
• offences for using, collecting or disclosing someone’s personal data for technology crime (up to one year, ฿100,000), rising to up to five years and ฿500,000 if the data is bought, sold, exchanged or used for gain.

The Digital Economy and Society Ministry has said that a holder may also be prosecuted as a principal or accessory in the fraud the account was used for, and sued by the victim. (Ministry statement, February 2025.)

Two tests

Section 9 needs a court, and asks what you knew. “Should know” is a lower bar than knowing, but it is still a question about the holder’s mind, and a prosecutor has to answer it.

The suspension system asks a different question: where the money went. The central bank sorts suspected accounts into colours:

• black: a person on the anti-money-laundering office’s list of those who have committed offences under the decree;
• dark grey: a person whose account is in the money trail of a fraud the victim has reported to the police;
• light grey: the same, but the victim has not reported it;
• brown: an account the bank itself sees behaving abnormally — “dark brown” where the bank is confident enough to tell the police, “light brown” where it is only suspicious.

Only black rests on anyone’s assessment that the person committed an offence, and that assessment is the anti-money-laundering office’s database, not a judgment. The other three — 78% of the count below — rest on a report, a money trail or a bank’s alert. None, as the central bank describes them, waits for a court.

What the count shows

The central bank’s cumulative table, to July 2026:

(Shares are this site’s arithmetic.)

Brown and light grey together are 2,396,284 accounts, or 55.7%. The table counts accounts, not people. The black count runs from March 2023; the others from January 2024, with brown reported by 17 institutions. It does not say how many accounts were later released.

The bank has since added August 2026: 4,421,289 accounts, of which brown 1,943,801 and light grey 531,692, together 56.0%. The pattern holds. (Added on 10 October 2026; the rest of this article uses the July figures.)

The total was 1,752,479 in December 2024. It has more than doubled since. The black count grew by 43,400 in the eleven months to June 2026, then by 96,613 in July alone. The table does not say why.

Against that, prosecution is small. The ministry said the police made 2,495 arrests in 2024 for mule-account and mule-SIM offences under the decree. At the end of that year the central bank’s count stood at 1,752,479 accounts. The two figures count different things — people arrested in a year, accounts suspended to date — and one person can hold several accounts. But one is roughly 700 times the other. The suspension is the instrument used at scale.

From one report to every bank

Since 1 August 2024, according to the central bank’s FAQ, when a victim reports a fraud to the 1441 hotline or a bank, the money trail goes into a shared database, the Central Fraud Registry. Every bank can see it. For a person in the grey categories, every bank suspends online banking on all of that person’s accounts as soon as the data arrives, and keeps it suspended until the account holder proves the facts in person at a branch.

In January 2025 the central bank widened this. Banks may now act on an account before any victim reports it, must share the names of people they find suspicious with each other, and must stop money going into high-risk accounts as well as out.

The decree’s own holds run on a clock. A hold a bank starts on its own suspicion lasts up to seven days unless the police or the anti-money-laundering office act (section 6). A hold a victim asks for comes with an instruction to file a police complaint within 72 hours, and lapses unless the investigator orders it continued within seven days of the complaint (section 7). The suspension of a person’s online banking, as the central bank’s FAQ describes it, has no fixed end. It ends when the holder proves their case.

The people in the trail

The central bank has said plainly that the system catches honest people. In September 2025 it said that the government’s technology-crime operations centre and the banks had widened the tracing of money trails to recover more for victims, and that this “may affect more honest people who are in the money trail”. Its answer was to make release faster: no more than four hours after the centre sends the data to the bank, in three batches a day, against the decree’s 72 hours or seven days.

Its earlier guidance to an uninvolved person whose account was suspended is to go to the bank and prove their good faith.

The list

The 2025 decree turned a name into a ban. It set up the Technology Crime Prevention and Suppression Operations Centre in the digital economy ministry and gave it power to announce the names of people, and the numbers of digital-asset wallets, connected with technology crime — and to withdraw them, under criteria it sets itself (section 8/5).

Once the centre notifies a name, every bank, payment operator and digital-asset business must refuse to open an account for that person, suspend service or transactions, or close the account, until the name is withdrawn (section 4/2). A bank that does not comply can be fined up to ฿500,000, and a director responsible up to one year and ฿100,000 (section 8/11).

The centre’s criteria were published in the Royal Gazette in March 2026. The ministry described them as covering wallet numbers, requiring immediate refusal, suspension or closure, and allowing the centre to withdraw a name if the person is found to be uninvolved. This site did not read the criteria themselves.

One thing has changed on the way. In 2024 the central bank’s FAQ said that a person listed as a mule might be refused a new account “unless it can be shown to be an account for living, such as a salary account or an account for receiving state welfare.” The 2025 decree’s section 4/2 contains no such exception in its text. Whether the centre’s criteria put one back was not established.

Article 50 Thailand skipped credit cards described PromptPay as infrastructure that reaches everyone. On the statute’s wording, a listed person can be refused at every bank and every e-money provider, which is also the way into PromptPay.

Young people’s accounts

On 31 July 2026 the central bank said that fraudsters were increasingly using the accounts of young people, who “may become involved without intending to” by opening an account for someone else or letting someone use theirs — which is an offence under the decree. Its FAQ adds that a young person caught up in it goes through the juvenile justice process, with their parents involved.

Its answer is a lower default limit on digital transfers and payments per day:

• aged 10 to 12: ฿3,000 (e-money only);
• 12 to 15: ฿5,000;
• 15 to 18: ฿10,000.

Banks were to apply it by 30 September 2026, e-money providers by 31 October, to existing and new accounts. A young customer can ask for a higher limit. The bank describes the measure as permanent.

Who pays back the victim

The 2025 decree also built a refund route that does not need a criminal trial (sections 8/1 to 8/4):

• the anti-money-laundering office examines the reports and publishes the accounts in the Royal Gazette;
• victims claim, and anyone connected with an account may object, within 90 days of publication;
• a committee of the office orders the refund; a party who disagrees can go to the civil court within 30 days;
• money nobody claims within ten years goes to the office’s fund, though a later claim is allowed with good reason.

And it made the providers share the loss. Banks, payment operators, telecoms firms, social-media platforms and digital-asset businesses share liability for a victim’s loss unless they prove they met their regulators’ standards (section 8/10). The central bank’s standards for banks, announced in April 2025, include one mobile-banking login on one device per bank, a face check for transfers of ฿50,000 or more, and, for people named as mules, measures matched to the risk, “such as” blocking money in and out of all their accounts and refusing new ones.

What this adds up to

Thailand wrote a crime aimed at the account holder and a harsher one aimed at the broker. Both need a court and a finding about what the person knew.

Beside them it built a system that does not ask. It reads money trails and bank alerts, and reaches every account a person holds at every bank. By the end of 2024 it had suspended 1.75 million accounts; that year the crime produced 2,495 arrests. By July 2026 the suspensions had reached 4.3 million. For most people whose banking stops, the question they face is not whether they knew. It is whether they can prove at a branch that they did not.

This is the pattern of article 150 The lawful range and article 146 The person holding the bag: the law attaches to the party it can see. The decree’s preamble describes fraudsters moving money through other people’s accounts. The account holder is the one person in that chain whose identity the bank has already checked.

None of this says the measures are wrong. The central bank describes its own task as a balance between limiting victims’ losses and the convenience of honest users, and it has changed the balance more than once. The point is narrower: the test that decides most outcomes is not the one written into the crime.

Not legal advice.

---

Common misconceptions

“A suspended account means you have been charged.” No. Suspension is a banking measure. The offence in section 9 needs a prosecution and a court.

“Only people who sell their accounts are suspended.” The central bank’s light-grey and brown categories cover accounts in a fraud’s money trail or behaving abnormally, without a police report. It has said honest people in the trail are affected.

“The law only punishes the account holder.” Brokers and advertisers face two to five years under section 10, with a minimum the holder’s offence does not have.

“A suspension lifts itself after seven days.” The decree’s transaction holds have time limits. The suspension of a person’s online banking across banks, as the central bank describes it, lasts until the holder proves the facts at a branch.

“Mule accounts are mostly students and poor people.” No official figure on holders’ age or income was found. The central bank says young people’s accounts are increasingly used.