A Fraud Crisis of Real Proportions
Thailand's online fraud epidemic is not a bureaucrat's abstraction. According to the Global Anti-Scam Alliance, 60% of Thai adults have been successfully defrauded within the past year; 72% encounter scam attempts, averaging roughly 172 per person annually. The estimated national toll has reached THB 115.3 billion a year in losses — a record — with Thai police reporting victims losing approximately THB 70 million every single day in early 2026.
The perpetrators are largely cross-border criminal syndicates — call-centre operations running from Myanmar, Cambodia, and Laos — that exploit social media advertising's low friction and near-total advertiser anonymity. Investment scam ads, AI-generated celebrity endorsements for fake financial products, and fabricated government notifications are their core tools. Social media platforms serve as low-cost delivery infrastructure with effectively zero identity accountability for who is paying to run the ads.
Against this backdrop, Thailand's regulators moved on two parallel tracks in 2026. The first is a new advertiser identity verification mandate — precise, commercially scoped, and proportionate. The second is a criminal warning targeting AI deepfakes — well-intentioned but potentially sweeping in ways that could reach well beyond fraud.
The ETC Notification: KYC for Advertisers
On May 5, 2026, Thailand's Electronic Transactions Commission published Notification No. 2 — formally titled "Measures for the Prevention of Technology Crime for Online Social Media Service Providers." The rule requires social media platforms to verify the identity of every paying advertiser before their ads appear. It takes effect November 1, 2026, giving platforms a six-month implementation runway.
Platforms have two verification routes: document-based checks using government-issued IDs — Thai national identity cards, passports, or corporate registration certificates — matched with facial comparison; or digital identity systems meeting the ETC's Identity Assurance Level standards, including Thailand's National Digital ID framework. Verification is valid for one year, after which re-verification is required. Platforms must also collect and retain advertiser identity data — name, identification number, contact details — for at least 90 days after the advertising relationship ends.
The design logic is sound. Scammers currently buy ads with near-zero identity exposure; that is a known structural vulnerability the KYC rule addresses directly. The rule targets a specific commercial transaction — the moment money changes hands for advertising — rather than reaching into user-generated content or restricting what ordinary users can post or share. Compliance obligations fall on platforms, not individuals.
Critics will note that the rule applies based on ad-targeting location, not advertiser domicile: any advertiser targeting Thai users must meet Thai verification standards regardless of where they are located. That imposes extra-territorial obligations on non-Thai platforms and smaller regional ad buyers who face non-trivial technical integration work. These are legitimate friction points. But they are manageable given the compliance timeline, and the current alternative — maintaining the advertiser anonymity that scam networks depend on — already carries a measurable cost that Thai consumers are paying daily.
The Deepfake Warning: Right Problem, Uncertain Limits
On June 14, 2026, Thailand's Anti-Fake News Centre issued a public warning that AI deepfake content violates existing Thai statutes through multiple pathways. Under the Computer-Related Crime Act, electronically altering images to cause embarrassment carries up to three years' imprisonment and a THB 200,000 fine; entering false or distorted data into computer systems reaches up to five years and a THB 100,000 fine. Defamatory deepfakes additionally trigger Criminal Code provisions carrying up to two years' imprisonment and a further THB 200,000 fine.
The strongest case for this approach is genuine: AI-generated deepfake videos of Thai celebrities endorsing fraudulent investment schemes have defrauded thousands of people. Fabricated audio and video of public figures circulate during political campaigns. These are concrete harms, and the Anti-Fake News Centre's impulse to invoke existing criminal law is understandable when civil remedies have proven slow and insufficient.
The problem is definitional precision. Neither the Computer-Related Crime Act nor the Centre's June warning draws a clear line between:
- Malicious fraud — a deepfake of a bank executive directing wire transfers
- Defamatory fabrication — a fake compromising video of a private individual
- Political satire — an AI-exaggerated parody of a public official's known position
- Artistic expression — a gallery-exhibited digital portrait with imagined speech
Thailand's Computer Crime Act has a track record of broad application. Journalists and political critics have faced charges under provisions written to address cybercriminals. Extending the same statute to "images altered to cause embarrassment" — without legislative clarity on intent, public interest thresholds, and context — creates a real chilling effect on legitimate satire, commentary, and creative expression. Satire has always embarrassed its targets; that is partly its function.
Two Instruments, One Crisis
The important distinction between these two 2026 regulatory moves is design precision. The advertiser KYC mandate is scoped to a specific commercial actor class at a specific transaction moment. The deepfake criminal framework reaches any person who creates or shares AI-altered content, and leaves definitional judgements to prosecutors and courts — a far wider aperture with far less predictable application.
Thailand has better-targeted alternatives available: requiring platforms to label AI-generated synthetic content, mandating advertiser KYC specifically for synthetic-media ad campaigns, or establishing civil liability for demonstrable, provable harms. Criminal penalties should be reserved for proven fraud and malicious defamation with demonstrated intent — not deployed as a catch-all for content that causes embarrassment.
The Path Forward
Thailand's fraud crisis is real, and neither 2026 measure is without merit. The advertiser verification notification is a workable model that other Southeast Asian regulators should study: targeted at a specific commercial actor, technically implementable, and does not touch expression. The deepfake criminal warning, by contrast, needs legislative follow-through — a dedicated statute with clear intent thresholds, explicit carve-outs for satire and journalism, and proportionate civil remedies as an alternative to imprisonment.
Good policy distinguishes between the fraudster running a scam ad campaign and the satirist mocking a politician's face with AI tools. Thailand's November compliance deadline will test whether its enforcement apparatus makes the same distinction.