Man convicted of using AI face-swap to breach financial accounts in China
A man in Nanjing, China was convicted of using AI face-swap technology to breach 23 victims' financial accounts by circumventing facial recognition security. He accessed the accounts after illegally purchasing personal data, and fraudulently spent 15,996 yuan; a court sentenced him to 4.5 years imprisonment and ordered remediation of the vulnerable financial platform.
What happened
Fu Mou illegally obtained 195 million pieces of personal information through online purchases, then used AI face-swap software to generate synthetic facial videos and accessed 23 victims' financial platform payment accounts using facial recognition authentication.
Fu Mou illegally changed payment passwords and bound mobile phone numbers for 5 victims, and fraudulently used 1 victim's payment account to purchase two mobile phones for a total of 15,996 yuan. He attempted to breach facial recognition systems on multiple financial payment platforms but succeeded with only one platform.
Reported impact
The targeted financial platform had security vulnerabilities in its facial recognition system that allowed the attack to succeed, while other platforms with stricter risk control systems prevented the fraud attempts.
Index analysis
The prosecutor's office noted that the platform's reliance on facial recognition alone as the sole authentication method created vulnerability, and that adding an additional layer of identity verification could have prevented the attack.
Experts noted that while no network is permanently secure and new vulnerabilities emerge with updates and iterations, anti-deepfake detection technology in the industry has achieved detection rates exceeding 95 percent.
Governance controls
The prosecutor's office issued a legal risk warning to the financial platform regarding the technical vulnerabilities exposed by the case. The financial platform has since completed remediation measures.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.