On 17 December 2025 (B.E. 2568), In a landmark case for Thai consumers, Thai Supreme Court decision 2624/2568 credit card fraud has changed how liability is allocated when criminals misuse stolen card data. The Supreme Court ruled that when there is a dispute about who actually used a credit card, the issuing bank – not the cardholder – carries the burden of proof. This decision has major implications for anyone using credit cards in Thailand, including expatriates and foreign business owners.
The Supreme Court ultimately dismissed the bank’s claim and ruled that the cardholder was not liable for the fraudulent transactions. The key point is simple but powerful:
When there is a dispute about who used a credit card, the burden of proof lies on the bank, not on the consumer
For foreigners living, working, or doing business in Thailand, this ruling is an important development in consumer protection and banking risk allocation. This article explains the case in clear English, outlines what it means in practice, and highlights what both consumers and banks should now expect.
Disclaimer: This article provides general legal information only and is not legal advice. Each case depends on its specific facts. If you are involved in a dispute, you should consult a qualified Thai lawyer.
Background to Thai Supreme Court Decision 2624/2568 Credit Card Fraud Case
Credit card fraud is a common issue worldwide, and Thailand is no exception. Typical patterns include:
- Card details being stolen online and used for e-commerce purchases
- Skimming at payment terminals
- Phishing and fake SMS/LINE messages tricking cardholders to reveal card data or OTPs
- Data leaks from merchants or compromised payment gateways
When suspicious transactions appear, many cardholders discover that:
- The bank demands full payment, relying on credit card terms and conditions; and
- The bank often treats any transaction recorded in its system as presumed valid, unless the cardholder can “prove otherwise.”
This practice places a heavy burden on consumers, who normally do not control:
- The bank’s IT systems
- The merchant’s payment device
- The security of third-party payment service providers
The new Supreme Court ruling directly challenges this “automatic assumption” that the cardholder must pay whenever a transaction appears in the bank’s system.
Facts of Thai Supreme Court Decision 2624/2568 (Overview)
According to public summaries of the judgment:
- A consumer/cardholder had his or her credit card data stolen.
- A criminal used the card information (not the physical card) to purchase goods without the cardholder’s consent.
- The bank sued the cardholder for repayment of the outstanding amount, arguing that:
- The cardholder contested the claim, stating clearly that:
The dispute went up to the Supreme Court, which had to answer a key question:
When there is a dispute about who actually used the card, who has the burden of proof – the bank or the cardholder?
What the Supreme Court Decided
1. Burden of proof lies with the bank
The Supreme Court held that, in a dispute over who used a credit card, the burden of proof falls on the issuing bank, not on the consumer. The Court’s reasoning can be summarised as follows:
- The bank designs and operates the credit card and payment systems.
- The bank controls:
- The bank is also the party that benefits commercially from issuing credit cards and collecting interest and fees.
Therefore, when the bank claims that “you used the card, so you must pay”, it is the bank’s responsibility to prove that:
- The cardholder actually performed the transaction, or
- The cardholder consciously allowed someone else to use the card, or
- The cardholder was grossly negligent in a way that enabled the fraud.
Simply pointing to system records or a statement of account is not enough to automatically assume that the cardholder is the person who used the card.
2. Transactions alone do not prove cardholder use
The Court emphasised that the existence of card transactions in the system does not automatically mean that the cardholder is the one who used the card.
To succeed, the bank must present concrete evidence, for example (depending on the case):
- CCTV footage at the point of sale clearly showing the cardholder
- IP logs, device IDs, or login records linking an online purchase to the cardholder
- Call recordings or correspondence showing the cardholder’s consent
- OTP records plus evidence that the OTP was sent to, and confirmed by, the cardholder’s device without any system failure or security weakness on the bank’s side
If the bank cannot present sufficient, reliable evidence, the Court cannot force the consumer to pay for what is essentially the criminal’s debt.
3. Result: claim dismissed, no liability for the cardholder
Because the bank in this case failed to prove that the cardholder:
- Made the transactions, or
- Gave consent, or
- Was grossly negligent,
the Supreme Court dismissed the bank’s claim and confirmed that the cardholder did not have to pay the disputed charges.
Legal Principles Underlying the Decision (In Simple Terms)
While the judgment is specific to its facts, it reflects several general principles of Thai law:
- Burden of proof in civil cases
- Contract terms cannot override core fairness
- Consumer protection and risk allocation
This judgment is therefore seen as a landmark in consumer protection in the financial sector in Thailand.
What This Means for Consumers in Thailand
1. It does not mean “you never have to pay”
First, an important clarification:
- The ruling does not give cardholders a free licence to deny legitimate debts.
- If the bank can show convincing evidence that, then you may still be liable.
2. It does mean the bank must investigate and prove its claim
However, the ruling shifts the starting point:
- The bank cannot simply rely on its system records and card contract to demand payment.
- It must make a serious, evidence-based investigation and be ready to prove its case if the cardholder disputes the transactions.
In practice, this should:
- Encourage banks to strengthen security systems (multi-factor authentication, anomaly detection, etc.).
- Discourage the practice of automatically blaming the cardholder whenever fraud occurs.
- Give consumers more confidence to challenge suspicious charges rather than paying out of fear.
3. Practical steps if your credit card is used by a scammer
If you are in Thailand and discover suspicious or clearly fraudulent credit card transactions, consider the following general steps (not case-specific advice):
- Immediately contact your bank
- Submit a written dispute
- File a police report
- Keep all evidence and communication
- Monitor further activity
- Seek legal advice where necessary
Implications for Banks and Financial Institutions
For banks and card issuers in Thailand, Supreme Court Judgment 2624/2568 sends several clear messages:
- Strengthen authentication and fraud detection
- Improve evidence collection and retention
- Review credit card contracts and terms of service
- Proactive customer communication
Frequently Asked Questions (FAQ)
If my Thai credit card is used by a scammer, do I still have to pay?
Not automatically. After this Supreme Court ruling, the bank holds the burden of proof to show that you made or authorised the disputed transactions, or that you were grossly negligent. If it cannot prove this, the Court may refuse to hold you liable. However, each case depends on its own facts and evidence.
Does this ruling apply to both Thai nationals and foreigners?
Yes. The ruling addresses the legal relationship between cardholders and banks in Thailand, not the nationality of the cardholder. If your credit card is issued by a bank operating under Thai law, the principles in this case can be relevant to you, whether you are Thai or a foreigner.
What if I accidentally gave my OTP to a scammer?
This is a fact-specific question. If you voluntarily provide your OTP to someone (for example, after being tricked by a phishing message), a court may consider whether this behaviour amounts to gross negligence. If it does, you may still be held liable. You should seek tailored legal advice in such a situation.
Can the bank still sue me for unpaid fraudulent charges?
Yes, banks can still file lawsuits. However, in light of this ruling, they must prove their claim, including that you are the real debtor for the disputed transactions. If they cannot satisfy the court with credible evidence, the claim may be dismissed.
What should I do if the bank keeps calling and demanding payment?
You can:
- Ask the bank to confirm its position in writing.
- Respond in writing that you dispute the transactions and refer to your prior reports.
- Keep records of all communication.
- If the pressure continues or legal action is threatened, consider consulting a lawyer to understand your options under Thai law.
Conclusion
Supreme Court Judgment No. 2624/2568 represents a significant step forward for consumer protection in Thailand’s financial sector. It confirms that:
- Banks, as system designers and beneficiaries of card services, must bear the burden of proof in credit card fraud disputes.
- Consumers cannot be forced to pay simply because a transaction appears on a statement, especially where they promptly deny any involvement.
- At the same time, cardholders still need to act prudently, protect their data, and respond quickly when fraud is suspected.
For foreigners and businesses using Thai banking services, understanding this new legal landscape is crucial to managing risk and protecting your rights.
Need help with a credit card or banking dispute in Thailand?
Lex Bangkok assists international clients with:
- Coordinating with Thai counsel in litigation or negotiation
If you are facing a dispute with a bank over unauthorised card transactions in Thailand and need clear, English-language guidance on your options, you should speak with a qualified Thai lawyer.
We can help you understand the legal framework and communicate effectively with local counsel so that your rights are properly protected under Thai law.