A mule account is a bank account opened in one person's name and then handed to someone else to receive money, while the person whose name is on it never uses it. Criminals want these accounts because money taken by deception has to pass through several accounts to break the trail before it is withdrawn. A mule SIM works the same way, except that it is a phone number rather than an account.

Many people still treat lending an account as a small favour, on the grounds that they did not deceive anyone themselves. Thailand has had a specific law setting out the penalty for this since 2023.

"Lend your account once, and the penalty is up to three years in prison."

The Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes, B.E. 2566, was published in the Royal Gazette on March 16, 2023. Section 9 provides that any person who opens or allows another person to use their deposit account, electronic card or e-money account without intending to use it themselves, or who allows another person to use their mobile phone number, while knowing or having reason to know that it will be used to commit a crime, is liable to imprisonment of up to three years, a fine of up to 300,000 baht, or both.

The phrase worth reading closely is knowing or having reason to know. The law does not require proof that the account holder helped plan the fraud. It is enough that they were in a position where they ought to have known. Saying that you had no idea what the other person was doing is not the shield many people assume it to be.

Those who procure accounts, advertise to buy them, or act as brokers trading accounts and SIM cards face a heavier penalty: imprisonment from two to five years, a fine from 200,000 to 500,000 baht, or both, under Sections 10 and 11.

Source: https://ratchakitcha.soc.go.th/documents/140A018N0000000000100.pdf

A second decree followed in 2025, published in the Royal Gazette on April 12, 2025 and in force the next day. The change that reshapes the whole system sits in Section 8/10, which makes financial institutions, mobile network operators, other telecommunications providers and social media platforms share responsibility for losses caused by technology crime, unless they can prove they complied with the standards set by their regulators.

This shifts the burden of proof. Previously the victim chased their own money. Now the service provider has to show it met the required standards in full. The second decree also creates new offences covering improper SIM registration and the use of another person's data, including that of a deceased person, to open an account or register a SIM.

Source: https://ratchakitcha.soc.go.th/documents/67320.pdf