TDAC Scam Warning 2026: Don't Pay for Thailand's Free Arrival Card

If you searched “Thailand arrival card” in the last hour and the first result asked for a credit card, close that tab. The official Thailand Digital Arrival Card (TDAC) is free, the only legitimate URL is https://tdac.immigration.go.th/, and .go.th is the only Thai government TLD on the entire internet. If a site ends in .com, .info, .in.th, .online, or .org, it is not the Thai government, full stop. I’ve been living in Bangkok since 2023 and I’ve watched first-time visitors, retired expats, and even friends with Thai PR pay between $20 and $130 for a form the Royal Thai Government delivers in three minutes for zero baht. This article is the calm version of the conversation I keep having in airport coffee shops.

The reason it matters specifically right now: on 29 March 2026, the Thailand Immigration Bureau issued its strongest public warning to date, with deputy commissioner and bureau spokesperson Pol. Maj. Gen. Choengron Rimpadee stating on the record that “registration is completely free of charge” and that roughly 10% of foreign arrivals had used fraudulent or fee-charging TDAC sites. Bureau math projects scam revenue could reach roughly $100 million / ฿3 billion by May 2026. The numbers are alarming enough that Bangkok Post, Khaosod English, Thai Examiner, Business Standard, and Travel and Tour World all ran the warning within 48 hours.

What TDAC Actually Is (and Why Scammers Love It)

The Thailand Digital Arrival Card replaced the old paper TM6 card that used to flutter inside passports at every Thai port of entry. It went live and mandatory on 1 May 2025 for all non-Thai nationals arriving by air, land, or sea, including children, infants, and non-Thai diplomatic passport holders. Thai nationals, airline crew, and passengers on technical landings or transit flights that don’t pass through immigration are exempt. The full ecosystem (visas, e-Visa, exemption rules, visa runs, border crossings) is covered in the broader Thailand entry guide 2026; this piece stays narrow on the fraud problem.

Mechanics in three lines:

1. Fill the form at https://tdac.immigration.go.th/ any time within the 72-hour window before arrival (earlier submissions are rejected).
2. Get a confirmation email with a QR code within minutes.
3. Show the QR at immigration on arrival, or have the immigration officer scan your passport. Both work.

The reason the form is such a juicy scam target is the combination of three factors. It is mandatory. It is unfamiliar (changed in May 2025, so 2026 is the first full year where every traveler hits it). And the URL is unintuitive: tdac.immigration.go.th doesn’t appear in most travel guides published before 2025, so anxious travelers Google “TDAC form” and click whatever ranks first. Whatever ranks first is often paid.

The Scam Ecosystem in Numbers (March 2026 Bureau Statement)

The most recent and most cited official warning came from the Immigration Bureau’s 29 March 2026 statement. The headline figures:

Metric	Figure	Source
Foreign arrivals using fake/fee-charging TDAC sites	~10%	Immigration Bureau, 2026-03-29
Projected scam revenue by May 2026	~$100M / ฿3 billion	Bureau math: 10% × ~33M visitors × ~$33 average fee
Typical fee charged	$20–$90 USD	Bangkok Post, Khaosod English, Business Standard
Documented family case	$120 per person for “urgent service”	THE Thaiger reporting
Highest documented payment	$130 for two cards (~$65 each)	Thai Examiner

Pol. Maj. Gen. Choengron Rimpadee, Deputy Commissioner and Bureau Spokesperson, was quoted in Khaosod English on 29 March 2026: “Registration is completely free of charge.” The Bureau also flagged data-protection risk, noting that personal information submitted to fraud platforms “could be misused, potentially exposing travellers to scams or identity theft.”

A few earlier warnings, for the record, so nobody can say “I never heard about this”:

• 1 May 2025 — Immigration Bureau social-media warning the same day TDAC went live.
• Early June 2025 — second warning round circulated through Royal Thai Embassies worldwide.
• 17 October 2025 — Ministry of Tourism and Sports issued a warning about fee-charging fake registration sites (reported by Khaosod English).
• 1 April 2026 — corporate-immigration advisory by Fragomen, restating the Bureau warning for business travelers.

A note on the 10% figure. It does not mean 10% of arrivals were criminally defrauded by phishing rings. It means roughly 10% of arrivals paid for what’s free. Some of those payments went to outright impersonators; some went to legal third-party agencies that happen to charge a fee. Both are problems for your wallet. Only one is fraud. The next section walks the difference.

The fee variance is wider than most travelers expect. Single-traveler payments cluster in the $20 to $90 range, with $33 cited by the Bureau as the rough average. Family bookings push higher because most fake sites multiply per person rather than offering a household rate. Press reporting documents a family-of-three case at $120 per person and a couple paying $130 for two arrival cards (about $65 each, slightly under the typical individual fee, suggesting a “couples discount” that is itself a marketing veneer). None of these prices reflect the actual cost of what was delivered, which is zero baht of government fee plus a few minutes of someone copying your data into the real form on your behalf, or in the worst cases, not even that.

Named Fake Sites and Patterns

Below are domains named in Immigration Bureau / press coverage between 2025 and 2026. They are listed in plain code text, with no live links, because clicking them benefits nobody. Status may change; this list reflects press coverage as of 9 May 2026.

Domains named in press coverage as fee-charging or fraudulent (March 2026)

These domains have been named in the March 2026 press warning round (Khaosod English, Thai Examiner, and adjacent outlets) as charging fees for what is a free government service. Some appear to be impersonators; some appear to be paid-agency middlemen marketing aggressively. Do not enter your details on any of them. Use the official portal.

• tdac.info: most consistently named across press coverage. Markets itself as a “document assistance service” charging fees.
• thailandarrivalcardtourist.com
• thailandarrivalcard2025.com: year-in-domain is itself a red flag (official sites don’t date themselves).
• thailandonarrivalweb.com
• australiaasiagroup.com: generic “agency” branding.
• travelsmarttravelfast.com
• thailandarrivalform.com

Domain-pattern red flags (memorize these as a checklist)

1. TLD is anything except .go.th. .com, .info, .in.th, .online, .org, .co.th: none of these are Thai government.
2. Year baked into the domain (2025, 2026). Government portals don’t expire annually.
3. Words like tourist, form, web, arrival, online stacked together.
4. arrival-card or digital-arrival-card as the primary domain string with a non-.go.th TLD.
5. Promises of “premium,” “fast-track,” “urgent,” “VIP,” or “expedited” service. None of these tiers exist; the official site is always free with a roughly three-minute email turnaround.

Scam vs. paid agency: the legal distinction

This article protects itself from defamation by being precise. Several websites charge a fee to fill out the TDAC on your behalf. They are legal but unnecessary, not scams.

Site	Status	Why we don’t call it a scam
ivisa.com	Commercial visa-processing platform	Openly identifies as a third-party paid service; doesn’t pretend to be the government
tdac.agents.co.th	Self-identified third-party agent (AGENTS Co., Ltd.)	Has its own anti-scam disclosure page; transparent about middleman role
thaiembassy.com	Visa-services site (independent of any embassy)	Discloses commercial third-party status
siam-legal.com	Bangkok law firm	Long-established firm; offers TDAC assistance as a paid service line

The line is simple. A site that uses Thai government colors, an emblem, and language designed to make you think it is the official portal is impersonation, and that is the scam. A site that says “we’ll do this for you for a fee” while remaining visually distinct from the government portal is a paid agency. Legal, but you can do the same thing in three minutes for free yourself.

How They Get You: Google Ads, SEO Black-Hat, Visual Mimicry

The single biggest acquisition channel for fake TDAC sites is Google Search Ads. Multiple investigations (Chiang Rai Times, AGENTS’ own scam alert page, a detailed Medium analysis by GRConors) confirm that paid-ad slots for queries like “TDAC form,” “Thailand arrival card,” and even “official TDAC website” frequently sit above the legitimate .go.th result. The first organic result might be the real one; the first thing the eye lands on, with a tiny “Sponsored” tag in light gray, is often not.

The second channel is SEO black-hat. Press analysis describes paid backlink networks pushing scam sites up organic rankings, plus reports of fraudulent DMCA-style complaints filed against the legitimate .go.th page in attempts to down-rank it. Some warning pages hosted on smaller travel blogs have reportedly been suppressed in certain geographies. None of this is unique to TDAC; it’s the standard playbook for any high-intent, government-adjacent query. But the scale around TDAC in 2026 is unusual.

The third channel is visual mimicry. Thai flag colors, royal-blue color palettes, official-sounding English (“Official Thailand E-Arrival Authority”), and emblems that look government-issued at a glance. None of it is illegal in itself; combined with a domain that contains the word “Thailand,” it’s enough to convince a tired traveler at 11pm before a 6am flight.

A practical note on browser warnings: Chrome and Edge generally do not flag these scam sites as malicious. The sites are technically functional and don’t host malware. They harvest data and money via a working web form, which is a category browsers don’t reliably catch. Don’t rely on a red browser warning as your safety check. Some browser extensions (Malwarebytes Browser Guard) have flagged specific TDAC scam URLs, but coverage is uneven and lags new domains by weeks.

What about the three observed outcomes after you submit a fake site’s form? Press coverage and post-mortem forum threads describe a rough trichotomy. In the best case, the operator manually re-submits your data on the real .go.th site for free, you receive a real QR code, and you only lose the fee with no operational consequence at the airport. In the common case, the operator submits something but you receive a confirmation that may or may not be the real QR; some victims arrive at immigration to find their TDAC isn’t on file and have to redo it at the kiosk. In the worst case, no submission happens at all, and the operator now holds your full passport details, address, flight info, and credit card. Plan for the worst case as your default; it’s the cheapest assumption to make and the easiest to walk back if it turns out you got lucky.

How to Verify a Site Is Real in 10 Seconds

You don’t need to know anything technical. You need three checks, in this order.

1. The URL bar reads tdac.immigration.go.th with no extra words before immigration. Ignore everything after the slash and focus on the domain. If the address bar shows tdac.info, tdac-thailand.com, arrivalcard.online, or anything other than the literal tdac.immigration.go.th, leave.
2. There is no fee field at any step. The official portal never asks for payment, never shows a price, never asks for credit card details. The moment a payment screen appears, you are not on the government site.
3. There are no ads, no Trustpilot widgets, no live-chat pop-ups, no “premium service” upsells. The real portal is plain government UI. The Royal Thai Government does not solicit reviews on Trustpilot.

If you want a fourth check: the official site has a language switcher in the top-right with English, Thai, Chinese, Russian, French, Spanish, Arabic, Japanese, and Korean. The switcher leads to manual pages at tdac.immigration.go.th/manual/. If the language menu sends you off-domain or to a dead link, leave.

If for any reason you arrive at the airport without a TDAC submitted, every major Thai port of entry has airport kiosks where you can complete the form on the spot. The Thailand airport guide covers the kiosk fallback in more detail. It’s slower than doing it from your hotel the night before, but it’s free and it works.

What to Do If You Already Paid

The recovery playbook splits by what you actually gave up. Money is recoverable in many cases. Passport data is harder.

Within 24 hours of payment

1. Contact your card issuer. Dispute the charge as fraud or unauthorized merchant transaction. Most cards allow chargebacks within 60 to 120 days, but success rates drop the longer you wait. Provide the URL, the email confirmation if any, and a screenshot of the charge.
2. Save evidence. Screenshots of the fake site, the email confirmation, the credit card receipt or charge line, and the URL exactly as you typed it. Keep them in a folder for the bank dispute and the police report.
3. Submit the legitimate TDAC at https://tdac.immigration.go.th/. For free. You still need the official one to enter Thailand. Some scammers do submit your data to the real site after taking your fee, in which case you’ll get a duplicate-submission error. Proceed anyway; the latest valid submission is what immigration sees.
4. If you’re already in Thailand, you’ve already cleared the kiosk. Focus on data-leak mitigation rather than card recovery, though the chargeback can still work.

Reporting in Thailand

Two hotlines matter, both 24/7 and toll-free:

• Tourist Police: 1155 — English-speaking, designed for tourist scams and incidents. Source: Tourism Thailand official 1155 page.
• Cyber Police / Anti-Online Scam Operation Center (AOC): 1441 — coordinates with Thai banks, can freeze suspicious accounts within hours if the fraud is reported quickly.

Two more for completeness:

• Online Complaint Center: 1212
• Anti-Fake News Center Thailand — for reporting the fake URL itself so it gets added to public warnings.

Reporting from your home country

• Your Royal Thai Embassy or Consulate — they relay reports to Bangkok and have repeatedly issued public warnings.
• Your local consumer-protection or cybercrime authority (FTC in the U.S., Action Fraud in the U.K., similar bodies elsewhere).
• If you came from a Google Ad, use Google’s “Report this ad” link on the ad itself. Google won’t refund you, but the report goes into the ad-quality moderation pipeline.

Identity-leak mitigation

If you typed your full passport details (number, date of birth, full name, address, email, flight info) into a fake form, treat the payment incident as a parallel data breach. Passport number plus date of birth plus address is enough for a credible passport-detail dossier on dark-web marketplaces.

1. Notify your passport-issuing authority. Most don’t reissue without proven misuse, but they can flag the number.
2. Watch for unusual account-opening attempts; consider a credit freeze if you have one available in your country.
3. Watch for follow-on phishing. The same data set is gold for “your e-Visa was rejected, click here” follow-ups. Treat any unsolicited message about Thai entry, e-Visa, or arrival card as suspicious for the next 90 days.
4. If you’re a frequent traveler, do future TDAC submissions only on a clean device or browser profile.

For broader context on the Thai scam landscape (gem shops, tuk-tuk overcharges, fake ticket vendors), the Thailand scams to avoid overview is the right next read.

Submit the Real TDAC: 5 Steps

This is the conversion-positive section. If you came here panicking, leave with the form done.

1. Open https://tdac.immigration.go.th/ directly. Type it. Don’t Google it. This avoids the paid-ad layer entirely.
2. Click “Arrival Card” and pick your scenario (individual or group). The site supports MRZ scanning of the passport bio-page from a phone camera, which fills most fields automatically.
3. Fill the remaining fields: flight number, arrival date, accommodation address in Thailand, travel purpose, contact email, and (only if arriving from a country flagged by the Thai Ministry of Public Health) a brief health declaration.
4. Review and submit. Confirmation lands in your inbox within roughly one to three minutes. The email contains a QR code as the deliverable.
5. Save the QR: take a screenshot, save to your phone wallet, or print a copy. Either showing the QR or having the immigration officer scan your passport at arrival will work. Thailand built the system to be redundant on purpose.

Submission window reminder: the form only accepts entries within 72 hours of arrival, including the arrival date itself. Earlier submissions are rejected. If you fly tomorrow at 6am, you can submit any time today. If you fly in five days, wait.

What You Do NOT Need to Pay For (vs. What You Do)

A clean reference table to avoid the next round of confusion. Free versus legitimately paid is not the same as legal versus scam.

Service	Cost	Where
TDAC submission	FREE	tdac.immigration.go.th only
Visa-exempt entry (countries on the visa-exempt list)	FREE	Stamped at the airport on arrival
e-Visa application	Paid (varies by nationality)	Official: thaievisa.go.th (also .go.th)
Visa-on-Arrival (eligible nationalities)	Paid (~฿2,000)	Paid in cash or card at the airport visa-on-arrival counter
Visa extension inside Thailand	Paid (~฿1,900)	Thai Immigration Office in person

The pattern: .go.th for the application, but the application itself may carry a legitimate government fee (e-Visa, visa-on-arrival, extensions). TDAC is the outlier; it’s .go.th and it’s free. If a .go.th site asks for a payment, that’s normal for visas. If a non-.go.th site asks for a payment for the TDAC, that’s the scam.

Once you’ve handled entry, the next practical task is usually getting a Thai SIM or eSIM, since most travelers want connectivity from the airport before they touch a taxi app. The Bangkok money and SIM card guide covers that bit, and once you’re connected, the Bangkok Grab vs Bolt guide handles the airport-to-hotel ride. None of this requires you to pay anyone for the TDAC.

FAQ

Is tdac.info the official Thailand Digital Arrival Card site?

No. tdac.info has been named in Immigration Bureau and major-press coverage since the March 2026 warning round as a fee-charging “document assistance service.” The only official URL is https://tdac.immigration.go.th/. The TLD .info is available for any registrant worldwide; the Thai government uses only .go.th.

Is ivisa.com a scam?

No, it is not a scam. iVisa is a commercial visa-processing platform that openly identifies as a third-party paid service. It charges a fee to fill out the TDAC form on your behalf, which is legal but unnecessary, since you can do the same thing for free in about three minutes at the official portal. The article distinguishes openly-disclosed paid agencies (legal but unnecessary) from impersonator sites (illegal). iVisa falls in the first category.

Is .in.th a Thai government TLD?

No. .in.th looks Thai because the country code is in there, but it is not restricted to government use. Any registrant who meets the .th policy can register a .in.th domain. The only Thai government TLD on the entire internet is .go.th. If a TDAC site sits on .in.th, .co.th, .com, .info, .online, or anything else, it is not the official portal.

What if I’m only transiting through Thailand?

If your itinerary is a transit flight that does not pass through Thai immigration (you stay airside, you don’t claim luggage, you don’t use a transit visa), you do not need a TDAC. Confirm with your airline before assuming this. The rule is “anyone who passes through immigration submits TDAC,” not “anyone who lands in Thailand.”

Do airline crew need a TDAC?

No. Airline crew arriving in Thailand on duty are exempt under the official TDAC FAQ. The exemption also covers passengers on technical landings or transit flights that don’t pass through immigration.

What if I miss the 72-hour submission window?

You can still submit at the airport on arrival. Every major Thai port of entry has TDAC kiosks for on-the-spot completion, and immigration officers can also scan your passport directly. It’s slightly slower than doing it from your hotel the night before, but it’s free and it works. For more on the airport process, see the Thailand airport guide.

What if I already submitted TDAC on a fake site, do I need to do it again?

Yes. Some scam operators do re-submit your data to the real site after taking your fee, but you cannot rely on that and you cannot verify it without checking the official portal. Go to https://tdac.immigration.go.th/ and submit yourself. If a duplicate-submission error appears, the real site has it; if not, you’ve just covered yourself for free. Either way, request a chargeback from your card issuer for the fee you paid the fake site.

Is the official site available in my language?

Likely yes. The official portal supports English, Thai, Chinese, Russian, French, Spanish, Arabic, Japanese, and Korean per the multilingual manuals at tdac.immigration.go.th/manual/. Use the language switcher at the top right.

Bottom Line

The Thailand Digital Arrival Card is a free government service. The only legitimate URL is https://tdac.immigration.go.th/. The only Thai government TLD is .go.th. The Immigration Bureau, on the record through Pol. Maj. Gen. Choengron Rimpadee on 29 March 2026, has stated this directly: registration is completely free of charge.

If you paid a fee to an impersonator site, the recovery path is chargeback within 24 hours, real TDAC submission at the official URL, and reports to Tourist Police 1155 and Cyber Police 1441. If you used a transparent paid agency like iVisa or AGENTS, you weren’t defrauded; you just paid for a free service. The practical fix in both cases is the same: take three minutes, open the official URL directly, fill the form, save the QR, and arrive at Suvarnabhumi or any other Thai port of entry without the anxiety.

For the broader entry picture (visa types, exemption rules, e-Visa, border crossings), the Thailand entry guide 2026 is the companion piece. For Bangkok-specific scams beyond TDAC, the Thailand scams to avoid overview covers the rest. For the airport-arrival sequence after you clear immigration, the Thailand airport guide and the Bangkok Grab vs Bolt guide handle the next two hours of your trip.