AI-powered ticket-snatching gang busted in Guilin, China
Police in Guilin, China arrested 12 members of a ticket-scalping ring that used an AI-powered image recognition model to bypass CAPTCHA verification on a scenic spot's ticketing platform, illegally obtaining about 10,000 tickets during October 2024. The gang trained the model by collecting and annotating thousands of CAPTCHA images and used it to automatically solve verification codes while submitting bulk ticket requests.
What happened
A 12-person organized group used software with an AI-powered image recognition model to bypass graphical CAPTCHA verification codes on a Yangshuo County scenic spot ticketing platform during China's October 2024 National Day holiday period.
The group trained a high-accuracy image recognition model by downloading thousands of CAPTCHA images from the platform, manually annotating correct answers, and then automatically solving CAPTCHAs during ticket purchases. They pre-registered tourist names and phone numbers in their software to automatically submit booking requests.
The gang illegally obtained approximately 10,000 tickets through this method, with advertisements for scalped tickets appearing on social media platforms.
Reported impact
Numerous online users reported difficulty obtaining tickets to the scenic spot during the October 2024 holiday period.
Index analysis
The incident demonstrates that graphical CAPTCHA verification mechanisms, particularly pattern-selection and text-selection types, carry significant security risks when image recognition tools are readily available.
The vulnerability existed because the CAPTCHA component had design flaws that made it susceptible to automated bypass techniques, and such components are widely deployed across various online applications.
Governance controls
Authorities recommended that organizations audit verification code components in registration, login, and critical business operations, strengthen monitoring and blocking of high-frequency requests and abnormal behavior, and promptly block suspicious IP addresses.
CAPTCHA service providers were advised to increase complexity through noise, distortion, font changes, and other measures, continuously identify security flaws, provide upgrade solutions, and fulfill legal notification obligations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.