I was recently a target of a scam in Thailand. I think it was nefariously but impressively sophisticated so I want to write more about it here as a public information for people to be aware of and hopefully don’t end up as a victim.

WHAT HAPPENED

• On 6 Sep 2023, I got a call on my mobile phone from a person saying that they are from กรมที่ดิน (Ministry of Land). They said they are calling to check up on the urgent document that they have sent to me 6 months ago without reply from me. They correctly quoted my house deed and asked me to call another number so I can talk to ฝ่ายกองทะเบียน (Registration Department) (062 093 4597) to follow up on this. He put pressure on me saying the deadline is today and I should get it sorted.
• When I called the number the same afternoon addressing to กฤษฎา (Kridsada), they confirmed the situation and asked to add me on Line app (Username: ‘E-QLANDS’) to continue the conversation. The Line person has a picture of a male in uniform. He insists that the whole process was free and there is no charge. We had a brief line message exchange and they asked to give me a call to explain for my convenience how I can verify my Land information via an online channel

• In parallel to all these conversations, I got sent this email including this document (from the following gmail address: thawikhongyun@gmail.com). The document contains the my correct ID number and the information in there seems legitimate. It says that I need to verify my land information asap. It gives me two options, either go to a land office in person which will take time and multiple documents, or do it online which only take 10-20 minutes and only your name and phone number. Note how it gives you an illusion of convenience by using the online route.

Title: “เอกสารการแจ้งการสำรวจและยืนยันข้อมูลผู้ถือครองกรรมสิทธิ์ที่ดินให้เป็นสถานะปัจจุบัน(ตกหล่น)”

• I called them on Line on 11 Sep 2023 and they ran me through the process saying that I can file this information online and they can walk me through the process. When i asked about doing it in-person, they kept saying that it’s likely easier to do it online. They asked me if I am using Android and to go onto my browser and type in the address ‘dol.oa-th.cc‘. This got me onto the Land registry website that looks somewhat legitimate. They then asked me to navigate to this one page in the website and to download an app from a link on this website to begin the e-service process.
• By this point, I concurrently was searching online and went on the dol.go.th page and found the following warning

• When I asked that DOL website said that .cc website is a fraud, the person on the phone started deflecting. I ended the conversation soon after without downloading anything.
• I never got another call from them and the line account I talked to got deleted about 5 days afterward.

IN HINDSIGHT

It is now clear what they were trying to do. They were trying to get me to download a malware onto my mobile phone. They can then likely access my mobile phone control and banking app and syphon money from my account. Android must have been a lot easier to override the security, hence their question about whether I was using an android or iphone.

IN REFLECTION

I was impressed at how sophisticated the whole exercise was. It got me to play along but thankfully I did not end up downloading the app and caused any further damage to myself. What I am objectively fascinated by is the psychology that goes into making this fraud attempt successful:

1. Lack of hard selling: There was no attempt to ask for money. The request to update your land information seems innocuous enough that it’s easy to follow along and be complacent. There is always an illusion of choice that we can stop at any time.
2. Urgency: Things need to be done quickly since I am apparently passed the deadline. The added urgency makes it easy to rush and follow the instruction without thinking.
3. Illusion of Options: The document and subsequent call offers two options to solve the issue, in-person visit which will take a long time and multiple documents or online which will take only 10-20 minutes. The criminals offer choices but tilt the advantage of convenience subtly towards their preferred option. If you want to sort this out, online just seems like a much better option.
4. Multiple touchpoints: I ended up talking to 3 people across phone calls and line. This subtly adds credibility as it didn’t feel like it is just one person doing everything. I went through multiple ‘departments’ which probably reinforced the credibility of a sprawling bureaucracy. By them convincing me to call back also lowers my defence as now I am the one actively initiating the conversation.
5. Accurate information. The document they sent to me contains my ID number and they accurately quoted my Land registry number. This adds a lot of credibility and trust and makes me think they are actually legitimate. Scary to think what leaks of your personal information are out there in the darkweb.
6. Clear and innocuous call to action. The criminal has deflecting questions to get you to download the app. The act of downloading the app seems harmless enough that we can do it without a second thought.
7. Accurate UI: The DOL website actually looks relatively reliable.
8. Legitimate obsfucation: Department of Land is obscured but important enough that the whole process feels legitimate

LESSONS LEARNT

1. Be sceptical of any calls you are not expecting, even if they post themselves as legitimate or quote accurate information of yours. It seems that your ID or even your property deed info are floating around the dark web for these fraudulent operation to exploit (at least mine are).
2. Don’t download anything onto your phone (apps or files) from any source you’re not familiar with. For apps, stick with Google App Store or Apple Store
3. Download any recommended malware blocker
4. Consider putting cash and savings you don’t use regularly in an account you can’t access by your regular phone

Be safe with your online activities and hope this can give you a flavor of what current cyber criminals are capable of so you’re aware and don’t get scammed!