In February 2025, Wu, a university student in Changsha who was close to graduation, bought a technology online: it converts a static facial photograph into a dynamic video capable of passing facial-recognition verification on payment apps. He did not send out résumés; instead, he posted advertisements in illicit and gray-market chat groups on overseas messaging apps to take orders.
The business worked like this. Upstream fraud groups impersonated short-video platform customer-service representatives or game streamers and, under pretexts such as “canceling automatic deductions” or “giving away game equipment,” induced victims to download remote-control software, obtaining the victims’ names, ID card numbers, mobile phone numbers, photographs and payment-platform verification codes. The information was passed to Wu, who uploaded the photographs to a conversion website to generate dynamic facial videos, paired them with the verification codes, and reset the victims’ payment passwords. Once a password was changed, he sent the payment code to a downstream “money-laundering fleet,” which scanned the code to transfer out the money in the linked bank accounts; after the money was obtained, it was returned to him in virtual assets in proportion. According to a report by Hunan Legal Daily, the accounts breached were the victims’ UnionPay QuickPass accounts. In less than four months, three victims were defrauded of more than RMB 50,000 in unauthorized transactions.
The group was fairly well organized: to join the group and take orders, one first had to pay a deposit in virtual assets as security, to prevent any link in the chain from leaving the group and keeping the information for itself after obtaining it. CCTV also disclosed another detail: the “virtual camera” used in the illicit and gray market could generate, in real time, footage of blinking, opening the mouth and turning the head, in order to defeat liveness detection.
Six links in this chain were occupied by different people, yet only Wu ended up in the defendant’s dock. But if you work on facial recognition or liveness detection, or if one step in your product is “face scanning,” or if your servers store users’ facial photographs, this case concerns you for longer than it concerns Wu. His prison term will be served within two years, but the gate that a synthesized video pushed open is still installed in your product.
The court convicted him of theft, not fraud
The Yuhua District Court convicted Wu of theft, with a huge amount involved, as a principal offender, and sentenced him to one year and ten months of fixed-term imprisonment plus a fine of RMB 3,000. The judgment has taken effect.
Many people’s first reaction is puzzlement: the whole process was deception, so how could it be theft?
The key is that the victims never handed over a single cent from beginning to end. The upstream group did deceive people, but what it obtained by deception was ID card numbers, photographs and verification codes; these are keys, not money. At the moment the money actually left the accounts, the victims were doing something else; they neither knew nor consented, let alone handed the money to anyone.
The establishment of fraud requires a complete chain: the perpetrator deceives, the victim believes it to be true, the victim voluntarily hands over property because of the mistaken belief, and the perpetrator obtains the property. The middle link is called disposal of property, and it is not as simple as “passing something over.” The Supreme People’s Court’s case-library reference case, the Ding Moujun fraud case, states clearly: an act of disposal is a change in the relationship of control over property and is not entirely equivalent to the act of handing something over in everyday life.
Ding Moujun impersonated a person assisting police officers in handling a case, borrowed a mobile phone from a minor to take photographs, told the minor to wait in place, and ran off with the phone. The first instance convicted him of theft; the procuratorate protested, and the second instance changed the conviction to fraud. The reason for the change was that the victim not only handed over the phone but also agreed that he could leave the scene with it, so possession was completely transferred; only that constitutes disposal. Conversely, if the victim had kept watching the phone nearby, possession would not have transferred, and if the perpetrator had taken it while the victim was off guard, it would still be theft.
Applying this standard to Wu’s case, the answer is obvious. The victims retained control over the money in their accounts the entire time; the money was transferred without their knowledge.
Article 264 of the Criminal Law of the People’s Republic of China: Whoever steals public or private property, if the amount is relatively large, or if the person commits theft multiple times, commits theft after entering a home, commits theft while carrying a weapon, or commits pickpocketing, shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention or public surveillance, and shall also or only be fined; if the amount is huge or there are other serious circumstances, the person shall be sentenced to fixed-term imprisonment of not less than three years but not more than ten years, and shall also be fined; if the amount is especially huge or there are other especially serious circumstances, the person shall be sentenced to fixed-term imprisonment of not less than ten years or life imprisonment, and shall also be fined or have property confiscated.
Article 266 of the Criminal Law of the People's Republic of China: Whoever defrauds public or private property, if the amount is relatively large, shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention or public surveillance, and shall also, or shall only, be fined; if the amount is huge or there are other serious circumstances, shall be sentenced to fixed-term imprisonment of not less than three years but not more than ten years, and shall also be fined; if the amount is especially huge or there are other especially serious circumstances, shall be sentenced to fixed-term imprisonment of not less than ten years or life imprisonment, and shall also be fined or have property confiscated. Where otherwise provided by this Law, such provisions shall prevail.
A machine cannot be deceived; circumventing it can only be treated as theft
Digging one layer deeper beneath this measure brings us to something harder, the master switch for characterizing all AI face-swapping crimes: the person defrauded in the crime of fraud must be a living human being.
A machine has no consciousness and cannot fall into a mistaken understanding, and therefore cannot dispose of property on the basis of a mistaken understanding. When a facial recognition system is passed by a synthesized video, from a technical perspective this is a system judgment error; from a legal perspective nothing has happened: no one was deceived, no one made a decision, only a line of defense was circumvented.
By way of analogy. Facial recognition is a lock that recognizes faces; using a fake face to open it is equivalent to making a fake key to open the door, not to persuading the homeowner to open the door for you. The former is picking the lock; only the latter is fraud. This analogy is not entirely precise: making a fake key at least requires a physical object, whereas synthesizing a video in this case merely involved purchasing a service online.
This is not theoretical speculation. The case of Bai Moukuan demonstrated it. Under the pretext of helping others apply for credit cards and loans, he took advantage of the opportunity to operate their mobile phones, deceived the victims into passing facial recognition, then secretly installed another lending application, took out a loan of 140,000 yuan in the victims' names and transferred it to his own account, and finally uninstalled the application and returned the phones. At the investigation stage the charge reported was fraud, and the charge on indictment was also fraud; when the case reached the court, the judge directly found that the charge alleged by the public prosecution authority was erroneous and changed it to theft. The reasoning in the judgment was succinct: the victim's loss of control over their property was not based on being deceived and voluntarily handing over the property.
Therefore, in cases of the AI face-swapping type, "who was deceived" is a crucial question. Only if a living human being was deceived is there room for the crime of fraud; if a system was deceived, legally it can only be handled as theft.
For the same AI face-swapping unauthorized transactions, why do some cases have a starting point for sentencing two years higher?
Many commentaries describe this case as "a good choice of charge, therefore a lenient sentence." That claim does not hold up.
In Hunan Province, the threshold for "huge amount" is 50,000 yuan for both theft and fraud. The more than 50,000 yuan obtained by Wu through unauthorized transactions falls exactly on this line whether treated as theft or as fraud, and the corresponding statutory penalty is likewise not less than three years but not more than ten years. Convicting him of theft did not reduce his sentence by a single day.
The court chose theft because the constitutive elements so required, not because one charge was more advantageous than another.
What truly widens the sentencing range are two other paths.
At the lighter end, it could be characterized as the crime of aiding information network criminal activities, for which the statutory maximum penalty is only three years. Wu could not be placed in that category: he did not provide technical support at the periphery of the chain, but personally produced the videos and personally reset the passwords—the core steps—and the court found him to be a principal offender. The same applies to the crime of infringing on citizens' personal information: it can only assess the upstream stage of obtaining information and cannot cover the result of the money being transferred away.
At the heavier end lies what is most worth the attention of fellow practitioners in this case: the threshold for "a huge amount" under the crime of credit card fraud is likewise RMB 50,000, but the corresponding statutory penalty is not less than five years and not more than ten years. For the same sum of just over RMB 50,000, proceeding under the crime of theft starts at three years, while proceeding under the crime of credit card fraud starts at five years—a difference of a full two years in the starting point of sentencing.
A nearly identical case in Jiangsu in 2024 was contested in exactly this way. Li used face-swapping software to generate dynamic videos, logged into the victim's e-commerce platform account by means of facial recognition, changed the payment password and the linked mobile phone number, and then used the bank card linked to the account to buy two mobile phones. The reason advanced for characterizing the conduct as credit card fraud was this: the Supreme People's Procuratorate's reply concerning the finding of another person's credit card and using it at an ATM has already recognized that, in this type of special fraud offense, a machine can be deceived; Li issued payment instructions to the bank in the name of the cardholder, and the bank mistakenly believed it was the cardholder himself, which constitutes using another person's credit card without authorization.
The principle that "machines cannot be deceived" is the prevailing view with respect to ordinary fraud, but clear disagreement has emerged when it comes to credit card fraud. The disagreement turns on the channel through which the money moved: in Wu's case, the money was transferred out by scanning a payment code on a third-party payment platform and did not directly enter a bank card account, so the theft route is smoother; in Li's case, the bank card linked to the account was used directly for consumption, so the shape of using a credit card without authorization is much clearer.
With the same technology, the same method, and even the same amount, the offense and the starting point of sentencing may differ depending on the channel through which the money flowed out. This is the most practical takeaway this case leaves for similar cases.
Article 196 of the Criminal Law of the People's Republic of China: Whoever commits credit card fraud under any of the following circumstances, if the amount is relatively large, shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention, and shall also be fined not less than RMB 20,000 and not more than RMB 200,000; if the amount is huge or there are other serious circumstances, shall be sentenced to fixed-term imprisonment of not less than five years and not more than ten years, and shall also be fined not less than RMB 50,000 and not more than RMB 500,000; if the amount is especially huge or there are other especially serious circumstances, shall be sentenced to fixed-term imprisonment of not less than ten years or life imprisonment, and shall also be fined not less than RMB 50,000 and not more than RMB 500,000 or have property confiscated:
(1) using a forged credit card, or using a credit card fraudulently obtained with a false identity certificate;
(2) using an invalid credit card;
(3) using another person's credit card without authorization;
(4) malicious overdraft.
A word on sentencing by the way. The statutory penalty for a huge amount under the crime of theft starts at three years; Wu was sentenced to one year and ten months, relying on the statutory mitigating circumstance of voluntary surrender, which allows the sentence to be reduced to the next sentencing range, that is, the bracket below three years. There is a point here that is often stated incorrectly: this kind of mitigation does not require approval by the Supreme People's Court; what requires such approval is mitigation based solely on the special circumstances of the case where there is no statutory mitigating circumstance at all. The family's full restitution and compensation obtaining the victim's forgiveness, together with pleading guilty and accepting punishment, was what allowed the sentence, after the reduction to a lower range, to move further down to one year and ten months.
As for the use of AI, no provision of the current Criminal Law lists it as an aggravating circumstance; it can only be taken into account by the judge as a discretionary factor reflecting social harm.
Article 63 of the Criminal Law of the People's Republic of China: Where a criminal offender has circumstances for mitigated punishment as provided by this Law, the offender shall be sentenced to a punishment below the statutory penalty; where this Law provides for several sentencing ranges, the offender shall be sentenced within the sentencing range immediately below the statutory sentencing range.
Divergence of Charges
Is Your Face Scan the Only Gate?
Back to enterprises. In the Wu case, only one person sat in the defendant's seat, yet six links stood along the chain: the seller of the technology, the operator of the conversion website, the person who fraudulently obtained information, the person who took orders and produced the materials, the person who scanned codes to transfer funds, and the person who laundered money and split the proceeds. Whether criminal liability spreads to both ends of the chain depends on whether "knowing" can be proven. The Yu case heard by the Hangzhou Internet Court in 2023 is a sample: the defendant sold face-swapping software, taught tutorials, and provided materials, and was found to have acted knowingly and to have actively supplied them. The court's statement bears repeated quotation: technological neutrality does not equal value neutrality.
For the vast majority of companies conducting business in good faith, the risk does not lie at that end; it lies in being the party that is bypassed.
This must first be made clear: AI crimes have no dedicated charge. There is no "AI face-swapping crime" in the Criminal Law, and there probably will not be one for some time to come. Judicial authorities still treat AI as a tool of the offense and return to those older charges to classify the conduct. Therefore, there is no need to wait for a new law to be enacted before beginning to respond; existing rules are sufficient both to hold people accountable and to impose obligations on you.
As for the obligations, the Measures for the Security Management of the Application of Face Recognition Technology have already been in force for more than a year since June 1, 2025. Jointly issued by the Cyberspace Administration of China and the Ministry of Public Security, they comprise twenty articles, and the most stringent is Article 10.
Article 10 of the Measures for the Security Management of the Application of Face Recognition Technology: Where other non-face-recognition technical methods exist to achieve the same purpose or meet equivalent business requirements, face recognition technology shall not be used as the sole verification method. Where an individual does not consent to identity verification through facial information, other reasonable and convenient methods shall be provided.
Where the State has other provisions on the application of face recognition technology to verify personal identity, those provisions shall prevail.
This article was originally aimed at mandatory face scanning, in order to give people the right to refuse "face scanning" for hotel check-in and "face scanning" to enter residential compounds. Yet when it lands in payment and financial scenarios, the direction is exactly the same: a door with only one lock means that once the lock is keyed, the entire room is open. The presiding judge, Lan Yi, directly cited this article when explaining the law and at the same time offered a judgment: a verification model based on single face recognition has vulnerabilities.
Another provision that is easily misread is Article 2, paragraph 2.
Article 2 of the Measures for the Security Management of the Application of Face Recognition Technology: These Measures apply to activities of applying face recognition technology to process facial information within the territory of the People's Republic of China.
Where facial recognition technology is used to process facial information within the territory of the People's Republic of China for activities involving the research and development of facial recognition technology or algorithm training, the provisions of these Measures shall not apply.
Some read this as an exemption, but that is a misreading. What does not apply is only "these Measures"; none of the rules of the Personal Information Protection Law on sensitive personal information, nor the requirement that the source of training data be lawful, is reduced in any way. Moreover, once a model is launched and provides recognition services to the public, it immediately falls back under these Measures. It is merely a different set of rules, not an exemption from liability.
The specific actions differ from company to company.
Manufacturers of facial recognition and liveness detection should write "whether it can block injection-type attacks" into their product specifications and commitments to customers. The virtual camera disclosed by CCTV is a typical injection-type attack: it does not perform in front of the camera, but instead directly inserts a forged video stream into the capture stage, and traditional blink, head-turn and mouth-open verification is basically ineffective against it. This has already moved from a technical advantage to a compliance baseline.
For companies that integrate facial recognition into their business processes, what most warrants self-inspection is not login, but changes to account control. The real turning point in the Wu case was not that he logged into the account, but that he reset the payment password. Changing the payment password, replacing the bound mobile phone number and raising the transfer limit are actions equivalent to handing over the keys to the account, and they should never be guarded by a single biometric feature. Placing a second factor of verification here is far more useful than deploying it on every login, and far less disruptive to users.
Companies that hold users' facial photographs should focus on three points. Article 8 sets the default rule: facial information should be stored within facial recognition devices and must not be transmitted externally via the internet; cloud-based comparison requires separate consent, which directly determines how the product architecture is built. Article 15 sets a deadline: where the volume of stored data reaches 100,000 people, filing with the cyberspace administration at or above the provincial level must be completed within 30 working days. Article 9 requires a personal information protection impact assessment to be conducted in advance, with reports and records kept for at least three years. Whether it has been done is obvious at a glance on inspection.
The Second Gate
Your face is the only password you can never change
A leaked password can be changed, a compromised mobile phone number can be replaced, and a lost ID card can be reissued. A face cannot.
Once it is collected, leaked or synthesized, it remains permanently in the material libraries of the black and gray industries, and you can never replace it for the rest of your life. This is why facial information is classified as sensitive personal information, and why those Measures require that it "must not be used as the sole verification method." Making a key that cannot be replaced into the only lock is itself a design error.
Wu's one year and ten months will soon be served, but the technology he bought is still on sale, and the price will probably only go lower. What really needs to change is not whether the sentence was heavy, but whether there is a second gate behind that gate.
If your product includes facial recognition, whether developed in-house or procured, there are two things worth lining up right now: whether actions that change account control have a second factor of verification, and whether the storage method and volume of facial information have crossed the filing threshold. Neither is difficult to check, but checking after an incident occurs is too late.
If you need assistance in developing a compliance plan for a specific scenario, you may leave a message in the backend.
Sources
- Hunan Legal Daily, "College Student in Changsha Sentenced to One Year and Ten Months for Using AI 'Face-Swapping' to Fraudulently Use Bank Cards," April 2, 2026
- CCTV News, "College Student Fraudulently Uses Over RMB 50,000 via 'AI Face-Forgery Videos': Inside a New Type of Black and Gray Industry Chain," August 16, 2026 (reprinted by The Beijing News, Zhongan Online, and others)
- Voc.com.cn, "College Student Sentenced for 'AI Face-Swapping' to Fraudulently Use Bank Card; Court Warns Your Face Is Being 'Left Exposed'," March 31, 2026
- Reference Case Included in the Supreme People's Court People's Courts Case Database: Ding Moujun Fraud Case (Database No. 2024-03-1-222-010), second-instance case No. (2015) Hu Yi Zhong Xing Zhong Zi No. 1769
- Shandong Courts, "Selected Viewpoints: Key Issues in Face-Recognition-Related Crimes (III)," including the Deng Mouhao Case and the Bai Moukuan Case (case numbers not disclosed)
- Jiangsu Legal Daily, "Determination of the Conduct of Online Fraudulent Use via AI Face-Swapping," August 22, 2024, Li Mou Case (case number not disclosed)
- Hangzhou Internet Court (2023) Zhe 0192 Min Chu No. 4563, Yu Mou AI Face-Swapping Personal Information Protection Civil Public Interest Litigation Case
- Articles 63, 67, 196, 253-1, 264, 266, and 287-2 of the Criminal Law of the People's Republic of China
- Order No. 19 of the Cyberspace Administration of China and the Ministry of Public Security, Measures for the Security Management of the Application of Face Recognition Technology, effective June 1, 2025
- Provisions of the Higher People's Court of Hunan Province and the People's Procuratorate of Hunan Province on the Specific Amount Standards for the Implementation of Theft Criminal Cases (Xiang Gao Fa Fa [2013] No. 12)
