Attorney Shao Shiwei | Shanghai’s First Case of Batch Registration of Game Accounts: Is Mass Account Creation Illegal? An Analysis of Criminal Risks in the Gaming Black and Gray Markets

Review of Typical Cases: Combined Punishment for Multiple Crimes in the Buying and Selling of Game Accounts

1. Shanghai’s First Case of Programmatic Batch Real-Name Registration of Game Accounts

In May 2025, the Jing’an District People’s Court of Shanghai rendered judgment in Shanghai’s first case of programmatic batch real-name registration of game accounts[i].

The defendant, Ma, utilized self-taught programming skills to develop software that bypassed the gaming platform’s slider verification, SMS verification, and single-IP frequency limits, thereby achieving automated batch account registration. Meanwhile, he obtained a large volume of citizens’ personal information through online downloads and exchanges with others, using it for batch real-name authentication.

Upon investigation, Ma generated over 110,000 sets of game accounts and passwords, corresponding to more than 60,000 items of citizens’ personal information. He subsequently provided these real-name accounts along with their associated identity information as a package to Liu for sale. Knowing that the aforementioned accounts were proceeds of crime, Liu still sold them externally, making a profit of over RMB 200,000, from which Ma gained over RMB 100,000.

Ultimately, Ma was sentenced to four years and six months of fixed-term imprisonment for the crimes of illegally obtaining computer information system data and infringing upon citizens’ personal information, with combined punishment for multiple crimes. Liu was sentenced to four years and three months of fixed-term imprisonment for the crimes of concealing and disguising proceeds of crime and infringing upon citizens’ personal information.

2. Illegally Obtaining Over 3 Million Items of Personal Information and Profiting Millions from Reselling Love and Deepspace Accounts

Lin operated an online store engaged in game leveling services and contacted Xie to write automation scripts. These scripts allowed for automatic login, check-ins, and completion of daily tasks within the game, used for batch account operation and nurturing.

Lin illegally downloaded a large volume of citizens’ identity information online, organized personnel to register accounts using virtual email addresses and complete real-name authentication, and then used scripts to batch “level up” the accounts, ultimately selling them through his online store.

Upon investigation, over 3 million items of citizens’ personal information were illegally obtained for real-name authentication of online game accounts; the sale of accounts yielded profits of over RMB 1.6 million; and the relevant scripts were identified as destructive programs.

In May 2025, the Changning District Procuratorate initiated public prosecution for the crimes of illegally obtaining computer information system data and infringing upon citizens’ personal information. The court ultimately sentenced both individuals to four years and five months of fixed-term imprisonment[ii].

Deconstruction of the Black and Gray Market Chain and Analysis of Legal Risks: Distribution of Criminal Liability Among Different Roles

In the black and gray market for game accounts, participants at different stages play distinctly different roles, and their legal liabilities vary according to their status as subjects.

At the upstream end of the industrial chain are the providers of technical tools. They develop and maintain infrastructure such as proxy IP pools, code-receiving platforms, and CAPTCHA-solving platforms. In judicial practice, if the tools they develop are specifically intended to bypass the security protections of gaming platforms, and they have generalized knowledge of such use, they may constitute the crime of providing programs for intruding into computer information systems.

Following closely are the providers of personal information, who are the collectors and vendors of citizens’ personal information. Such entities obtain massive combinations of “name + ID number” through channels such as database leaks, web crawling, and dark web transactions, selling them in batches with tiered pricing based on the completeness of the information. They do not participate in account registration, existing merely as “raw material suppliers.” However, the threshold for the crime of infringing upon citizens’ personal information is extremely low—500 items of sensitive information or a profit of RMB 5,000 is sufficient for criminal liability.

The technical implementers at the core of the industrial chain are the most critical group in such cases. They write automation scripts, integrate resources from various parties, and mass-produce finished real-name accounts. These subjects face the highest criminal risk, often simultaneously violating multiple charges such as illegally obtaining computer information system data and infringing upon citizens’ personal information. However, there is also the greatest scope for defense—if it can be proven that they were unaware of the authenticity of the information and were responsible only for program development without participating in the acquisition of information, the charge of infringing upon citizens’ personal information may be dismissed on a case-by-case basis, resulting in a lighter sentence for a single crime.

Downstream sales distributors push finished accounts to end-users through e-commerce platforms and social groups. They often use coded language such as “game leveling” or “starter accounts” to evade regulation. The core charge for sellers is the crime of concealing and disguising proceeds of crime; if they also resell personal information during the sales process, they may additionally constitute the crime of infringing upon citizens’ personal information. Notably, if sellers lack clear knowledge of the illegality of the account sources, or engage only in normal account transactions, there may be grounds for exoneration.

Three Major Misconceptions About Criminal Risks Most Likely to Trap Practitioners

In handling such cases, we have observed a noteworthy phenomenon: many individuals involved in game account trading hold cognitive biases regarding the legal boundaries of their conduct.

Taking the two cases in this article as examples, the actors may have initially intended only to profit from selling game accounts—in their view, such merchants are common on Taobao and Xianyu, with many peers, and even if there were issues, it would amount to no more than a civil dispute.

However, from the perspective of criminal evaluation, this understanding involves several key points that require special clarification.

First, the change in the nature of the means of conduct. 

Routine account transactions, if the source of the accounts is lawful and the method of transaction is compliant, indeed may not trigger criminal risk. But when the subject matter of the transaction consists of accounts generated by batch registration software, and tens of thousands of items of real citizens’ personal information are attached to these accounts, the nature of the transaction may change. The actor is handling not just accounts, but also accompanying ID information—the latter directly triggers the constituent elements of the crime of infringing upon citizens’ personal information.

Second, claiming ignorance does not naturally isolate one from criminal risk.

In judicial practice, participants in different roles often develop psychological expectations of liability exemption based on their positioning. Technical personnel or studio heads tend to believe that only the direct sale of personal information violates criminal law, and that as “users” or “buyers” of information, they can remain aside as long as they do not delve into the source of the information. Sales personnel often argue that they are only responsible for the circulation of accounts, and whether the upstream source of the accounts is legal has nothing to do with them.

However, it must be noted that when determining subjective knowledge, judicial authorities do not rely solely on the oral statements of the parties but infer it through objective evidence such as transaction patterns, price structures, communication records, and the state of accompanying information.

Third, being at the end of the chain does not naturally mean the risk is minimal.

In black and gray market cases, legal evaluation often exhibits a distinct characteristic of “chain penetration.” Even if located only at the sales or monetization stage, if one is determined to have generalized knowledge of the illegal upstream sources, one may still be evaluated as an accomplice or aider in the crime of concealing and disguising proceeds of crime.

In the case adjudicated by the Shanghai Jing’an Court, Liu did not participate in front-end technical development or information acquisition, being responsible only for external sales, yet was ultimately held criminally liable. This point carries significant warning value in practice.

Against the backdrop of accelerated development in the digital economy, the state’s judicial protection of virtual property and related industrial order is continuously strengthening. Although the cases involved in this article are individual instances, the adjudication logic and regulatory orientation they reflect have certain indicative significance. It is hoped that this article will serve as a reference for relevant practitioners to understand current judicial practices, ensuring that necessary legal bottom lines are maintained during business promotion and technological application.