Purported Face‑Swap Technology Reportedly Used to Circumvent Financial Platform's Facial Recognition Security in Nanjing, China

In Nanjing, Jiangsu Province, a defendant (Fu Mou) was convicted in October 2024 for allegedly using AI‑powered face‑swap software to bypass an unnamed financial platform's facial recognition system. Authorities reported that he obtained over 1.95 million pieces of personal data, accessed 23 victims' payment accounts, changed passwords for several, and used one linked bank card to make purchases. Prosecutors said only one platform was successfully breached.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrator used AI face-swap software to impersonate victims and bypass facial recognition to steal funds, which represents targeted exploitation for personal financial gain.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The financial platform's facial recognition system failed to robustly distinguish between a real human face and an AI-generated dynamic video.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by a human actor who intentionally used AI face-swap software post-deployment to bypass biometric security and commit financial fraud.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI-generated content such as deepfakes ('AI换脸软件') to bypass security, which falls under the category of deepfakes/synthetic media requiring transparency, though its malicious use here constitutes fraud.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Face Recognition
• Behaviour type: Tool
• Alleged developer: Unknown face-swap technology developer, Unknown deepfake technology developers
• Alleged deployer: Fu Mou
• Alleged harmed parties: Unnamed financial payment platform, Individuals affected by compromise of 1.95 million+ personal records, 23 unnamed victims whose payment accounts were accessed

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations involving the illegal acquisition and use of personal information.

Directly caused: The perpetrator illegally obtained over 1.95 million pieces of citizen personal information and used them to attempt unauthorized access to 23 victims' financial accounts.

Inferred additional harm: The massive database of 1.95 million stolen records suggests a broader systemic privacy breach affecting numerous citizens whose data remains compromised or circulated.

People affected

• Occurrences reported: 1
• People reportedly harmed: 23
• People reportedly exposed: 1950000

Potential causes

Management

• Inadequate Security Auditing: The platform management failed to patch known facial recognition flaws.

Technology

• AI Face-Swapping Software: AI generated dynamic videos mimicking user actions to bypass recognition.
• Vulnerable Liveness Detection: The platform's facial recognition failed to identify fake dynamic videos.

Data Inputs

• Leaked Personal Data: Over 1.95 million personal records were bought online by the criminal.

Human Factors

• Low Personal Security Awareness: Victims allowed their personal information to be leaked and sold online.

Process and Methods

• Single-Factor Authentication: The platform allowed password changes using only biometric facial scans.
• Weak Risk Control Systems: Unlike other platforms, this platform had security vulnerabilities.

Regulatory Environment

• Illegal Online Data Trading: Black markets allowed easy purchase of massive personal information.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from official Chinese media (CCTV) provide clear, consistent, and detailed factual accounts of the crime, the court sentencing, the specific technical methods used (dynamic video generation to bypass liveness checks), and the exact number of victims and financial losses.
• Ambiguities identified: The specific name or developer of the AI face-swap software used by the perpetrator is not identified.
• Alternative interpretations: None. The facts of the criminal case and the role of the AI tool are clearly established by the court ruling.

An individual in China used AI face-swap software and stolen personal data to bypass biometric security on a financial platform, committing minor fraud. The incident highlights evolving vulnerabilities in biometric authentication systems to AI-generated synthetic media, posing minor long-term technological security concerns but negligible immediate national security impact.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: China
• Alleged perpetrator: Fu Mou

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding the robustness of biometric security against AI deepfakes, rather than an active national security crisis.
• Autonomy: Human-controlled. The AI face-swap tool was directly controlled and utilized by the human perpetrator to generate specific dynamic videos, with no autonomous decision-making by the software.
• Novelty: Evolved capability. Represents an evolution in biometric spoofing techniques, using AI to simulate dynamic facial movements to defeat standard security systems.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety elements were impacted or threatened by this incident.
• Information security: Negligible. The incident involved local financial fraud and did not compromise intelligence capabilities, classified models, or involve state-level information operations.
• Sovereignty: Negligible. There was no disruption to government operations, electoral systems, state authority, or constitutional processes.
• Economic security: Minor. Exposes a minor vulnerability in biometric authentication systems on financial platforms. However, the economic impact was negligible and localized to a single platform.
• Societal stability: Minor. While 1.95 million personal data records were illegally acquired, the scale of actual exploitation was limited to 23 victims, representing a minor localized privacy and fraud issue rather than systemic societal destabilization.