AI face-swapping used in account takeover and identity fraud in Wuhan
Wuhan police arrested four suspects who used AI face-swapping technology to bypass facial verification systems and seize control of a media company's social media account, which was then used to direct followers to investment services. The operation involved specialized roles in a criminal network offering unauthorized account access services.
What happened
An MCN institution's public social media account was breached, with the registered legal representative information altered and account password changed. The account posted messages announcing plans to stop updating and directing followers to an investment app account.
Wuhan Internet Police investigation revealed the breach was enabled by AI face-swapping technology used to bypass the platform's facial recognition verification system. Police arrested four suspects: Aicheng, who performed the AI face-swap operations; and Aiming, Aibin, and Aihua, who acted as intermediaries recruiting Aicheng, collecting victim information, and distributing proceeds from the 'face-passing' gray market operation.
Reported impact
The company's social media account, containing followers built through years of operation, was seized and repurposed to promote unrelated investment services, placing the organization's reputation at risk and potentially misleading its followers.
Index analysis
The attack exploited vulnerabilities in static facial recognition verification systems, which can be defeated by AI-generated video deepfakes showing a different person's face. The scheme required advance collection of victims' biometric data to generate the synthetic video material.
The operation involved a multi-tier criminal network where specialized roles—video generation, victim recruitment, and profit distribution—indicate an established supply chain for unauthorized account access services within China's underground markets.
Governance controls
Police recommended that platforms strengthen verification systems by adopting liveness detection and dynamic validation techniques to prevent spoofing via static photos or recordings. Platforms should also implement multi-factor authentication combining passwords, SMS codes, and facial recognition to protect account login security.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.