BANGKOK, THAILAND – Routine cardless cash withdrawals at Thai ATMs increasingly stalled in 2026 as banking apps demanded immediate facial verification.
Biometric checks disrupt everyday ATM use
At ATMs across Thailand, customers using smartphone apps for “cardless withdrawal” often saw their transactions abruptly interrupted by a demand for biometric verification. Instead of receiving cash within seconds, they were prompted to complete a face scan while standing directly in front of the machine, frequently in bright sun or poor lighting.
The apps required visible interaction – such as movement, reactions or a smile – before releasing funds. When scans failed repeatedly, accounts were temporarily blocked for that specific operation, turning what had been a smooth digital service into a test of patience for many bank customers.
No fixed 5,000-baht rule, but tighter algorithms
Reports in social media and expat forums claimed there was a new nationwide 5,000-baht ceiling for scan-free withdrawals. According to information available from the Bank of Thailand for 2026, however, no such blanket legal limit existed, and customer experiences stemmed from other mechanisms.
Thai financial institutions increasingly relied on dynamic security profiles instead of fixed thresholds. Algorithms monitored user behaviour in real time and triggered extra camera-based identity checks whenever a transaction diverged from established patterns, regardless of the amount involved.
Risk factors that trigger facial verification
Banking AI systems reacted to a range of risk indicators, including unusual withdrawal times or the use of an ATM in a province different from the customer’s registered residence. The use of a new smartphone could also activate the security layer without warning.
Frequency of use played a role as well: customers who used cardless withdrawal only rarely were more likely to be checked than those who relied on it daily. The stated aim was to ensure that any deviation from a standard profile did not signal a compromised account.
Older customers face more frequent checks
Statistics cited by banks indicated that older account holders were more often targeted by fraud attempts, prompting institutions to set more sensitive filters for customers over 65. While intended to protect assets, this meant seniors encountered verification prompts more frequently in everyday banking.
For many older users, holding a phone at the required angle and position at an ATM was more demanding than entering a six-digit PIN. The added motor and visual effort turned simple cash access into a more complex task for this age group.
“Liveness detection” raises both security and friction
Modern Thai banking apps deployed so‑called “liveness detection” to distinguish real users from images. Static photos of a face were rejected; the system instructed users to blink, open their mouths or slowly turn their heads before approving a transaction.
This technology was designed to stop criminals from exploiting a stolen phone with printed photos or video clips of the owner. The app checked in real time that a living person was in front of the lens, significantly boosting security while also increasing the complexity of everyday app use.
Sunlight, shadows and dirty lenses cause failures
The reliability of facial recognition depended heavily on environmental conditions. In Thailand’s strong sunlight, harsh shadows on the face and reflections on the phone display often prevented the software from capturing a clear biometric image.
Dirty front cameras were another frequent source of errors. Sweat, fingerprints or dust on the lens produced blurred pictures that failed to meet strict bank standards, causing transactions to be cancelled and customers to start the process again.
What happens when scans keep failing
When multiple attempts failed, some apps temporarily locked the function to guard against brute-force attacks. Customers then found themselves at the ATM unable to access funds, with no quick way to bypass the biometric barrier.
Experts advised users to remain calm in such situations, as abrupt movements or frustrated expressions could confuse AI analysis. Cleaning the camera lens and seeking a neutral background before a new attempt increased the chances of a successful scan.
Customers change withdrawal habits
In response to the hurdles, many customers quietly adjusted their withdrawal behaviour. Instead of taking out large sums at once, they opted for smaller amounts in an effort to stay below internal trigger thresholds in the systems.
If, for instance, a planned withdrawal of 10,000 baht prompted a scan, users often tried again with a lower amount. Transactions below an internal activation value were frequently processed without additional biometric checks, although this was not guaranteed because the algorithms continued to learn.
Structuring: splitting withdrawals to avoid scans
The practice of making several small withdrawals in quick succession became known as “structuring”. A customer might withdraw 4,000 baht five times instead of taking 20,000 baht at once, often avoiding a scan on each individual amount.
Banks, however, closely monitored such transaction chains. While structuring could solve an immediate problem at the ATM, frequent repetition risked flagging the account for suspicious patterns, making it at best a short-term workaround rather than a sustainable strategy.
Crackdown on mule accounts behind stricter controls
The tighter measures were rooted in Thailand’s campaign against so‑called “mule accounts”, opened by strawmen and used by criminals for money laundering and online fraud. These accounts were often operated with shared credentials, making traditional password-based security easier to circumvent.
Biometric verification was intended to ensure that only the registered account holder exercised control over funds. By tying access to a live face scan, banks aimed to create a barrier that regular customers could pass but fraud networks found harder to bypass.
Central bank rules push wider use of biometrics
The Bank of Thailand had set the basic framework for such security layers. Since 2023, transfers from 50,000 baht and up, or total daily transfers above 200,000 baht, had required mandatory biometric confirmation under central bank rules.
Banks were obliged to implement these requirements to protect their licences and often went beyond the minimum. Many institutions extended biometric checks to lower amounts or to higher-risk transaction types, including cardless cash withdrawals at ATMs.
Cybercrime surge in Southeast Asia
The pressure on Thai banks stemmed from rising cybercrime across the region, where phishing, app manipulation and identity theft caused annual damages measured in the billions. Security architectures had to evolve constantly to respond to new threats.
Facial scans were viewed as one of the safest authentication methods currently available. Passwords and PINs could be stolen or observed, whereas a person’s face was a unique attribute that was harder to fake or transfer to another individual.
Different banks, different customer experiences
Not all banks in Thailand applied the guidelines in the same way. Some major lenders, such as Bangkok Bank and Kasikorn Bank (KBank), reportedly used particularly strict algorithms, while others interpreted risk parameters more flexibly.
The technical quality of the apps also varied. Certain applications featured more robust facial recognition that worked better in poor light, whereas others reacted more sensitively to shadows and movement, leading to diverging user experiences.
Updates can silently reset security limits
Problems frequently emerged after updates to banking apps or smartphone operating systems. New versions often reset security settings to default values, causing previously increased limits for cardless withdrawals to drop back to low base levels.
Customers often only discovered these changes when standing at an ATM. To avoid surprises, banks recommended reviewing the “Limits & Security” menu after major updates and adjusting settings before attempting a large cash withdrawal.
The limit-adjustment trap
Customers who found their limits set too low could usually change them within the app. However, raising limits typically required a successful face scan, sending those already struggling with camera or lighting issues into a frustrating loop.
The only practical solution in such cases was often to move to an environment with optimal lighting, such as an indoor area with neutral illumination, perform the scan to change the limit, and only then return to the ATM.
Outdated biometrics force branch visits
A common reason for failed biometric checks was outdated reference data. If the photo stored by the bank was several years old, changes such as ageing, new glasses or facial hair could alter the geometry of the customer’s face enough to cause repeated mismatches.
Banks therefore recommended regular updates of biometric data through “Know Your Customer” procedures in branches, where a new reference image was captured and cross-checked against the customer’s passport.
When the app refuses: back to the branch counter
If an app persistently rejected biometric verification, a visit to a physical branch became unavoidable. Customers were required to bring both their passport and smartphone so staff could review account status, lift possible blocks and recalibrate facial recognition.
Banks advised customers to take this step proactively while other sources of cash remained available. Branch closures on weekends or public holidays could otherwise turn a technical problem into a more serious short-term liquidity issue.
Plastic cards return as a crucial backup
The growing dependence on apps and cameras led to a quiet comeback of the classic ATM debit card. Based on EMV chip and PIN technology, the physical card generally did not require biometric checks for standard cash withdrawals.
Long-stay visitors and expats were urged to keep at least one physical card as a backup, even if it carried a small annual fee, to provide a reliable fall-back when a phone failed, the battery died or facial recognition repeatedly malfunctioned.
Advice for tourists and foreign visitors
Tourists were encouraged to familiarise themselves with their home bank’s authentication methods before travelling. Setting up and testing banking apps in advance, and ensuring the phone camera was fully functional and scratch-free, reduced the risk of problems abroad.
In addition to digital preparation, travellers were advised to carry cash reserves in euros or US dollars and multiple physical cards from different providers. Diversifying means of payment offered protection against a complete technical outage while in Thailand.
Data protection under Thailand’s PDPA
The collection of biometric data in Thailand fell under the Personal Data Protection Act (PDPA). Banks were required to store this highly sensitive information in encrypted form and to use it solely for authentication, with third-party access tightly regulated.
Customers were nonetheless urged to handle their data carefully. Face scans should be performed only within official banking apps and never via links in emails or SMS messages, which remained a hallmark of phishing attempts seeking to harvest credentials.
Biometrics set to become the banking norm
According to the sector’s outlook, the shift toward biometric banking was considered irreversible. Future systems were expected to rely even more heavily on body characteristics such as facial features, fingerprints or voice profiles, with technology gradually becoming more resilient to adverse lighting and other environmental factors.
For customers, this meant a period of adjustment in which the smartphone definitively became the central key to personal finances. Maintaining hardware and keeping biometric records updated with the bank would become as important as protecting a traditional PIN code.
Security trade-offs reshape ATM routines
The current obstacles to cardless withdrawal were the direct result of tightened security rules rather than arbitrary technical glitches. Even in the absence of a fixed 5,000-baht rule, individual risk profiles produced similar effects at the point of cash access.
Customers who prepared in advance and kept alternatives such as plastic cards at hand remained able to act despite stricter controls. The article concluded that with some patience and planning, the digital hurdles of everyday banking in Thailand in 2026 could be managed as a necessary safeguard rather than a mere inconvenience.