14 Account and Information Security

Google counted 350000 real account takeover attempts (also called account hijacking). One class uses device-based verification, such as a pop-up on your phone for you to confirm, or plugging in a security key. That class blocked “more than 94% of phishing-related hijacking attempts and 100% of automated hijacking attempts.” Phishing means tricking you into entering your password on a fake site; automated means machines trying leaked passwords in bulk. Another class uses knowledge-based verification, such as where you last logged in or what your backup email is. That class “blocked as little as 10% of phishing hijacking and 73% of automated hijacking.” Within device verification, an SMS code is weaker than a phone pop-up. Phishers got 4% of the SMS codes right; the pop-up was fooled only 1% of the time. In targeted attacks aimed at a specific person, SMS blocked only 76%, and the pop-up blocked 90%

Trying leaked account-and-password pairs from elsewhere against your logins is called credential stuffing, and your email gets tried this way too. Once someone is in your email, every account that uses it for password recovery goes with it. The US Cybersecurity and Infrastructure Security Agency recommends a different strong password for every account, at least 16 characters, stored in a password manager

After a phone is lost, the fastest move for whoever finds it is to put the SIM in another phone and collect your SMS verification codes. With those codes they can reset your accounts one by one. With a SIM PIN, another phone asks for the code at startup, so they cannot use the card to receive codes. In October 2020 the Ministry of Industry and Information Technology (工信部) reported a real case. After a user’s phone was stolen, they did not suspend the line in time, which left a gap. Wrongdoers used “mobile number plus verification code” to log into a government service app and obtained the user’s ID number and other data. They then changed the mobile service password. The user later suspended the card, and they talked the carrier’s customer service into unsuspending it. Finally they exploited a “forgot password” flaw on a lending platform, reset the payment password, and stole loan funds. MIIT used the case to remind users to set a SIM PIN promptly and to suspend the line immediately when a phone is lost. For the screen-lock half, the US Federal Communications Commission advises setting a strong password on the phone to limit others’ use; when the phone is lost or stolen, that helps stop unauthorized charges and misuse of personal data

Order matters more than speed. First, suspend the SIM so others cannot receive your verification codes. Second, remote-lock the phone and wipe its contents. Third, from a computer, change email and payment passwords. Fourth, report to police and get a receipt. Last, freeze bank cards as needed. The US Federal Communications Commission also says that even if you think you only misplaced the phone, remote-lock it; if it was stolen, report to police at once with model and IMEI (the phone’s identity number), and tell the carrier immediately

Supreme People’s Court rules split “who must prove what.” If you say it was counterfeit-card fraud or online fraud, you go first with evidence. Counterfeit-card fraud means someone copied your card and used the copy. Usable proof includes effective legal documents, where the physical card was during the transaction, where the transaction occurred, account statements, transaction alerts, police reports, suspension records, and so on. Conversely, if the issuing bank or a non-bank payment institution (third-party payment) says the cardholder made the charge or authorized it, they must produce the evidence. After you notify the bank, if it does not verify promptly or does not provide or preserve transaction records and surveillance video, and evidence is lost because of that, the bank bears the consequence of lacking proof. Once liability is established: debit card (savings card) holders may demand that the bank return stolen deposits with interest and compensate losses; credit card holders may demand return of unauthorized overdraft principal, interest, and penalties, and compensation for losses, and courts will not support the bank demanding repayment of that overdraft from you. You may also demand that the bank promptly remove related negative credit records (nationwide, effective 25 May 2021)

The logged-in-devices list records which phones and computers can still use the account. The authorized-apps list records third-party apps you allowed to sign in with the account. Unfamiliar devices and long-unused third-party apps are the easiest traces to spot. The UK National Cyber Security Centre lists “logins or login attempts from unfamiliar places or at unusual times” as signs of account compromise. It also says criminals often add a forwarding rule in email so every message to you is copied to them, which they use to reset your passwords. Its recommended order is: remove unknown forwarding rules, change the password, then sign out all devices and apps. After sign-out, anyone else needs the new password to use the account. The US Federal Trade Commission likewise advises signing out all devices after regaining an account and deleting forwarding rules you did not set

The law states two rules. First, a provider may not refuse products or services on the grounds that the person does not consent or withdraws consent, except where processing that information is necessary to provide the service. Second, collection must be limited to the minimum needed for the purpose; only what is usable may be collected

In several situations the company must delete proactively: service stopped, agreed retention period ended, you withdrew consent, the original collection purpose was achieved, and so on. If it did not delete, you may demand deletion. If it refuses your exercise of these rights, it must state the reason. You may sue directly in court

The Administrative Measures for the Safe Application of Facial Recognition Technology (人脸识别技术应用安全管理办法) state: “Where the same purpose can be achieved or equivalent business requirements met, and other non-facial-recognition methods exist, facial recognition must not be the sole verification method. Where an individual does not agree to identity verification via facial information, other reasonable and convenient methods shall be provided.” The measures also state: “No organization or individual may, under the pretext of handling business or improving service quality, mislead, defraud, or coerce an individual into accepting facial recognition to verify identity.” If processing relies on consent, there must be “separate consent given voluntarily and explicitly with full knowledge”: asked separately for this matter, and you agree separately. You may withdraw consent, and the processor must provide a convenient way to withdraw. Processing facial information of minors under 14 requires consent from a parent or other guardian. Face recognition devices in public places must be “necessary for maintaining public security” and carry prominent notices. Inside private spaces in public venues such as hotel guest rooms, public baths, public changing rooms, and public restrooms, no organization or individual may install them. Facial information shall be stored on the device and must not be transmitted over the internet, except as otherwise provided by laws or administrative regulations, or with separate consent (nationwide, effective 1 June 2025)

In June 2026 the Ministry of State Security issued a risk alert. Some proxies retain user submissions on servers; some intercept privately and resell data to other model vendors for training. Some hide backdoors that implant malicious code on user devices, steal account keys and cloud credentials, or even install remote-control software. The alert recommends official direct connections or properly licensed platforms, and not using platforms of unknown origin without operating credentials or security safeguards. Desensitize personal privacy and project material before use, manage keys, and rotate them on a schedule. On abnormal billing, unexplained account bans, or odd data, stop use immediately, rotate keys, run antivirus, and preserve evidence. Researchers from UC Santa Barbara and others measured this in 2026. They bought 28 paid proxies from Taobao (淘宝), Xianyu (闲鱼), and overseas shops, and collected 400 free proxies from public communities. 1 paid proxy and 8 free ones injected malicious code into returned tool calls. Tool calls are commands AI has your computer run, such as installing a package. 2 timed their attacks; the paper’s example is targeting only fully automated sessions. 17 touched Amazon Web Services keys the researchers had planted on purpose. 1 moved funds from a researcher’s Ethereum wallet; the wallet held very little, and the loss was under 50 US dollars. The demonstrated tampering was subtle: swap requests for the near-identical reqeusts in an install command, hard to spot at a glance (nationwide)

The Anti-Telecom and Online Fraud Law (反电信网络诈骗法) states that telecom authorities must “provide a convenient channel for users to query phone-card information in their name.” The People’s Bank of China and other departments must “provide customers a convenient channel to query bank accounts and payment accounts in their name.” The nationwide mobile phone-card ID lookup (一证通查), guided by the Ministry of Industry and Information Technology (工信部), went live on 14 September 2021. With an ID card you can check how many phone cards are in your name and which carriers they belong to. It was launched because anti-fraud work found that some phone cards used in cases had been opened under someone else’s identity. The person did not know, and their personal credit could also be affected. The result is texted from 10699000 within 48 hours. If the count does not match, go to the carrier for the details; after you authorize it, they can verify, detach the number from your identity, shut it down, or close the account. In July 2022 they launched ID lookup 2.0 (一证通查). With your mobile number and the last 6 digits of your ID number, you can see how many internet accounts are linked to that number. At the time it covered Tencent, Alibaba, Baidu, Kuaishou (快手), Douyin (抖音), JD, Meituan (美团), and others, and the result is only a count. On the bank-card side, China UnionPay opened Cloud QuickPass card lookup (一键查卡) to every province and city in mainland China on 29 June 2022. Pick the banks to check, pass identity verification, and submit. A report is generated within 24 hours; card details in the report are masked, and it is deleted automatically after 7 days (nationwide)

The Telecommunications Service Standards (电信服务规范) state that “the freeze period for a mobile number is at least 90 days,” meaning the time from cancellation until the number can be issued again. 90 days after cancellation, the number may go to a new user. The Ministry of Industry and Information Technology telecom service quality notice for the first quarter of 2025 reminds users of the recycled-number refresh service (二次号码焕新) in the major carriers’ apps. If you are given a number someone else used, you can unbind internet accounts registered to that number before your line was opened. The second-quarter notice in 2026 says the service already covers 258 commonly used internet apps, and unbind applications have passed 850 million. That new owners must make a special effort to unbind shows that the previous owner’s accounts were still tied to the number after it reached them. In 2024, customer service at the major carriers told People’s Post and Telecommunications News (人民邮电报) that after a number is cancelled, a new user can still log into accounts the old user registered, using SMS codes. They said to unbind Alipay, WeChat, and similar apps before changing or cancelling a number, and to update the mobile number on file at the bank promptly (nationwide)