The Personal Data Protection Commission (PDPC) has urgently demanded mobile operators explain after discovering agents tricking students into scanning their faces in exchange for SIM cards, which were then used to activate over 2,000 fraudulent "ghost SIM" numbers.
On 25 Feb 2026, the Anti-Online Fraud Center (ACSC) of the Royal Thai Police, together with the Central Investigation Bureau (CIB) and the Crime Suppression Division, launched the “SAFE Doi BOY” operation. They raided eight targets in Chiang Rai, Chiang Mai, Samut Prakan, and Prachuap Khiri Khan provinces following reports of agents deceiving students into participating in a “free SIM card giveaway” event. The students’ data was then used to register over 2,000 fraudulent SIM cards that were passed on to scammer networks. Authorities arrested three suspects under warrants and seized 2,160 SIM cards, two mobile phones, and documents related to sales and advertising of SIM cards. This case prompted the Personal Data Protection Commission (PDPC) to urgently monitor and require mobile service providers, as data controllers, to clarify the facts and strictly review their data protection measures.
Police Colonel Surapong Plengkham, Secretary-General of the Personal Data Protection Commission, said mobile service providers, as personal data controllers, must implement measures to supervise their employees and agents, ensuring they understand and comply with the company’s security policies. This is essential to strictly protect personal data and the rights of data owners, namely the citizens who use their services. In the event of a breach, companies must review and strengthen these measures to prevent similar incidents from recurring.
The PDPC will continue to strictly oversee companies’ compliance with the PDPA law to fully protect the rights of the public as required by law. Schools should also carefully scrutinize any external parties conducting activities involving the collection of students’ personal data before granting permission. In particular, facial scanning involves sensitive data that impacts the rights and freedoms of students, a vulnerable group that requires extra caution in the collection, use, or disclosure of their personal information.
If there are suspicions of personal data violations or questions about personal data protection laws, individuals can contact the PDPC at phone number 0 2111 8800 or via Facebook: Personal Data Protection Commission - PDPC.
." Government Policy " More