How to Tell a Real Thai Government Website From a Fake
A scammer can clone a government page in an afternoon, but cannot clone its address. Here is how to check in ten seconds — before you type your ID number or pay.
A page that looks right proves nothing
Cloning a government page is not hard. Everything you see on screen has already been sent to your device, and anyone who copies it onto their own site ends up with a near-identical page. The one thing they cannot copy is the address, because a domain name has exactly one owner in the world. A real check starts there, not with the appearance.
Why the domain ending carries the most weight
A .go.th domain is not open to just anyone: the applicant has to be a state body and has to produce documentation from it. A global domain such as .com or .xyz costs pocket change and is issued within minutes, with nobody asking who you are. That restriction is why a domain ending is worth more than everything printed on the page put together.
- .go.th — Thai government bodies; the most common and most trustworthy group.
- .or.th — state enterprises, public organisations, foundations and associations; the Metropolitan Electricity Authority uses mea.or.th.
- .co.th — companies registered in Thailand, including some state enterprises.
- Other endings — .com, .net, .xyz — can be registered by anyone anywhere, so they tell you nothing about who owns them.
Reassuring signals, and signals to back away from
| What to look at | Reassuring | Back away |
|---|---|---|
| The domain ending | .go.th or .or.th of a body that genuinely exists | Ends in .com, .xyz or something unfamiliar |
| Where the agency name sits | Immediately before the first slash — dbd.go.th/ | The name appears early; the real domain is something else |
| How you got here | Typed it, opened a bookmark, or used the official app | Tapped a link in SMS, LINE, email or a search ad |
| Where the money goes | A payment channel inside the agency’s own system | A transfer into an account in a personal name |
The link that comes to you is the dangerous one
Almost every bad outcome begins with a message that came looking for you: an SMS about a parcel held at the depot or a tax refund waiting, a LINE forward passed around the family group with the best of intentions, an email signed off as most urgent. What they share is timing — they arrive when you are busy, and they offer a link that is easier to tap than opening the site yourself. A forward from someone close to you is no safer, because they almost certainly did not check either. If there is an older relative in the house, bookmark the sites they use, so a safe way in already exists before the alarming message arrives.
If you have already handed something over
What usually makes the damage worse is not ignorance but the time lost to embarrassment and to wondering who to tell. Start by separating what actually left your hands. Card details or an OTP are a matter of minutes. A name or an ID number may cost you nothing today, but expect the next approach to know more about you, and so to sound more convincing.
Why this page exists
ThaiGov.co is an independently made directory of Thai government online services. We are not part of any agency; we never collect personal data and never take payments for anyone. What this page is really for is the habit of reading an address — a skill that travels with you to every page you meet from here on, not only the ones we happen to list.
How to use it
-
Enter nothing yet — read the address bar
Before you type an ID number, a phone number or any card details, move your eyes to the browser’s address bar. On a phone it is usually shortened, so tap it once to see the whole thing. These ten seconds are the most effective check you will make.
-
Find the first slash, then read backwards
The real domain is the part sitting immediately before the first single slash — not the first words you happen to see. An address shaped like rd.go.th.secure-login.xyz/… is not a government site: its real domain is secure-login.xyz, and “rd.go.th” was pasted in front so a quick glance would reassure you. This is the most common trick of all.
-
Check what that domain ends in
Once you have isolated the real domain, read its ending. Almost every Thai government body sits on .go.th, while some state enterprises and public organisations use .or.th or .co.th. If the page claims to be a department or a ministry but ends in .com or .xyz, treat it as fake until proven otherwise.
-
Arrive under your own steam
If the matter reached you by SMS, email or LINE, set that message aside and open the agency’s site in a way you control: type the address, use a bookmark, or open the official app already on your phone. Anything genuine will still be waiting when you get there yourself.
-
Scroll past the sponsored results
The first result is not automatically the real one — scammers buy ads against official-sounding terms too. Look for the small label marking a result as an ad, scroll past it, then read the domains of whatever remains.
-
Ask what the page is asking of you
Some requests no Thai agency makes, however polished the page: an OTP code, your password, a full card number, or immediate payment to avoid a fine. If you meet any of them, stop there. You owe no explanation to whoever is on the other end.
-
Already entered something? Three things, now
First, contact your bank at once — using the number on your card or the help channel inside your own banking app — and ask them to freeze the card and hold anything suspicious. Second, change every password you reused elsewhere, starting with your main email and your banking app. Third, keep screenshots and the full address, then file a police report. Speed matters more than embarrassment.
Frequently asked questions
Is a site ending in .or.th or .co.th a fake?
Not necessarily. State enterprises, public organisations and some other bodies have used .or.th or .co.th for years — the Metropolitan Electricity Authority sits on mea.or.th. Read the whole domain rather than just the ending: if the organisation named in it matches the body you meant to contact, and you reached the page under your own steam, the two agree.
I tapped the link but entered nothing — am I in trouble?
The risk is far lower than entering details or installing something. Close the page, type nothing, grant no permission prompt that appears, and install no file or app it offers. If you did install an app from outside the official store, or granted it control of your screen, treat that seriously: disconnect, uninstall it, and check your bank accounts straight away.
What about apps and official LINE accounts?
The same principle: reach them through a route you control. Download apps from your platform’s official store and check that the developer really is the agency. For LINE, look for the verified badge and avoid adding an account from a QR code that has been forwarded around. Safest of all is to open the official website first and follow its own links out to any other channel.
I checked and I am still unsure — now what?
Treat the uncertainty as your answer: do not enter anything yet. Then confirm through a channel you already hold — call the number printed on your own bill or official paperwork rather than the one attached to the message. Anything genuine survives a day’s delay without harm; anything fraudulent tends to fall apart the moment it is checked.
Related services
MEA e-Service
No robots.txtCheck your electricity bill, pay it, review past usage, request a new supply and report an outage with the Metropolitan Electricity Authority — 24 hours a day through MEA e-Service. Direct link to the official system.
DBD Company Records
Partially blockedLook up any registered Thai company free — registration number, capital, directors, trading status and years of filed financial statements — on DBD DataWarehouse+.