The regulator’s latest directive requires mobile network operators to categorize and register A2P (application-to-person) SMS senders by origin, deploy SMS firewalls to screen risky international traffic, and prepend a clear alert symbol to messages that have passed the filter but still originate overseas. The NBTC also plans to register SIM boxes so that only authorized devices can connect to telecom networks—an attempt to cut off infrastructure often used by call-centre gangs and bulk messaging fraudsters. The Bangkok Post reports that operators have been blocking more than a million inbound scam SMS daily, with the trend accelerating in recent weeks.

These measures build on earlier initiatives: in 2021, Thai mobile operators publicly committed to crack down on spam and fraudulent SMS content, including gambling and phishing campaigns, with processes for blacklisting senders and consumer hotlines to report abuse. In 2022, the NBTC also considered tools that allow users to block overseas calls by default and distinguish international traffic with specific prefixes—a policy direction consistent with today’s SMS-specific push.

Below, we examine the regulatory mechanics, operator and enterprise implications, and how these moves may ripple across A2P messaging, fraud prevention, and the wider mobile ecosystem.

The NBTC’s clampdown on overseas SMS is a decisive step in an ongoing, cat-and-mouse struggle against telecommunication fraud.”

What NBTC is mandating now

• Categorization of A2P senders: Operators must maintain separate, clearly registered categories for domestic and overseas senders, improving sender-of-record auditing and enforcement.
• SMS fire-walling: Carriers are to deploy filters that screen risky inbound international SMS content before delivery.
• Visual alerting: International SMS that pass screening will be flagged (e.g., with an exclamation mark) to alert users.
• Consumer notification: Operators should promptly inform subscribers about these changes and the meaning of new indicators.
• SIM box registration: From November, only registered SIM boxes—devices often used for high-volume, sometimes illicit, termination—can connect to networks, limiting gray-route abuse.

The regulator ties these measures directly to a rise in scam SMS volumes. Notably, network-level requirement plus sender registration indicates a strategy that combines content screening and traffic provenance controls, two pillars of contemporary anti-fraud frameworks in messaging.

Why it matters: the fraud context

Thailand, like many other markets, is witnessing a shift in the way fraudsters operate. As call-based scams become increasingly difficult to execute due to enhanced blocking and detection, malicious actors are pivoting toward SMS, messaging apps, and multichannel attack strategies. According to NBTC officials, while the number of scam calls has dropped, inbound scam text messages have risen sharply, prompting the regulator to implement a tougher set of countermeasures. From a fraud prevention perspective, this new framework emphasizes three critical elements. First, improving origin transparency ensures that messages from domestic and international sources are clearly distinguished, helping both enforcement agencies and users identify potential risks. Second, real-time filtering via operator firewalls introduces scale-based safeguards that automatically detect, and block spoofed identities, low-quality traffic, and known phishing patterns. Finally, ecosystem hardening—through the registration of SIM boxes and tighter controls on messaging gateways—makes it far harder for bad actors to leverage unauthorized or “gray route” channels for large-scale spam and fraud. Together, these measures align Thailand with the global best practices in combating A2P abuse, where fraud mitigation increasingly relies on a coordinated mix of network-level controls, verified sender IDs, intelligent filtering, and sustained consumer awareness.

International alignment and precedents

NBTC’s approach aligns with global trends where regulators push for:

• Verified sender IDs and A2P registries to curb spoofing.
• Carrier-grade SMS firewalls to detect phishing and malicious URLs.
• Traffic labelling to enhance user awareness.
• Stricter controls on SIM farms and boxes used for illicit bulk traffic.

Markets in APAC and EMEA have adopted variants of these measures, often alongside industry codes of conduct. The Thai context is notable for the scale, over one million inbound scam SMS blocked daily, and for coupling SMS policy with voice measures, such as overseas call labelling and blocking options considered earlier. 

What to watch in implementation

• Precision of filters: False-positive rates will determine enterprise friction. Expect whitelist processes for critical transactional senders (banks, government agencies, global platforms).
• Cross-border cooperation: Aggregators and upstream carriers must ensure clean routes and verified origins to avoid blanket filtering.
• SIM box enforcement: Registration efficacy and audits will be key; expect fraudsters to probe other paths (e.g., OTT spam, number rotation).
• Consumer comms: Clear education on the meaning of international markers and reporting pathways will influence user behaviour and scam outcomes.
• Metrics transparency: Publishing aggregate block rates, complaint volumes, and takedown statistics can help build trust and guide iterative policy.

Implications for the wider Mobile Ecosystem community

For MEF members—operators, CPaaS providers, brands, and security vendors—Thailand’s move underscores three broader themes:

1. Trust as a competitive asset: A2P channels retain value when users believe messages are authentic. Investments in sender verification, template registration, and content hygiene are table stakes in high-fraud markets.
2. Compliance-by-design: Enterprises should architect global messaging with country-specific registries, route provenance controls, and rapid remediation paths. CPaaS platforms that abstract this complexity gain strategic advantage.
3. Omnichannel risk displacement: Tightening SMS controls often pushes attackers to OTT and social channels. Coordinated brand protection—across SMS, RCS, WhatsApp, and voice—becomes essential, with shared threat intel and unified monitoring.

MEF can play a convening role by documenting best practices, advocating interoperable registries, and facilitating cross-border threat intelligence exchanges that help members anticipate and adapt to evolving rules.

MEF CEO