Digital Security and Privacy

Two-factor authentication means an extra verification step beyond the password when logging in. Using a pop-up prompt on your phone that requires a single tap to confirm blocks over 90% of phishing and account theft attempts. In contrast, older verification methods such as answering questions like “Where did you log in last time?” or “What is your backup email?” only block around 10% of such attacks.

Cost

No cost involved. Each account takes just two to three minutes to set up once.

Benefit

Google analyzed 350,000 real-world account hijacking attempts. For authentication methods relying on device verification — such as phone pop-ups or physical security keys — over 94% of phishing-related hijacking attempts and 100% of automated hijacking attempts were prevented. These automated attempts involve bots using leaked passwords to try logging into accounts in bulk. For verification based on answering personal questions, only 10% of phishing attempts and 73% of automated attempts were blocked.

Note

The same study also found that these verification methods occasionally block legitimate users from accessing their accounts. 52% of real users failed to log in on their first try. However, 97% of them eventually gained access. It is recommended to enable this feature on email accounts first, as most other accounts allow password recovery via email.

If a password you use elsewhere gets stolen, attackers can use it to log straight into your email account. Once they gain access to your email, they can reset passwords for any other accounts linked to it. Therefore, your email password must be unique and never reused anywhere else.

Cost

No cost involved. Storing it in a password manager eliminates the need to memorize it. The real challenge lies in breaking the old habit of reusing one password across multiple sites.

Benefit

Credential stuffing is one of the easiest attack methods: attackers simply test stolen passwords against other accounts. If your email password is compromised, all accounts that rely on it for password recovery become vulnerable too. The US Cybersecurity and Infrastructure Security Agency recommends using a distinct, strong password of at least 16 characters for every account, and storing it via a password manager.

Note

If you struggle to memorize passwords, use the built-in password manager in your web browser. It stores passwords for each site for you, which is far safer than reusing the same password everywhere. Avoid saving passwords in WeChat favorites or note-taking apps.

The SIM card is that tiny card inside your phone that receives SMS verification codes. If your phone gets lost, a finder can remove the card and insert it into another phone to receive those codes, then reset all your accounts one by one. Setting a PIN on the SIM card means that whenever the card is moved to another phone, the user must enter that PIN before the phone can be used — effectively blocking that path.

Cost

No cost at all. You only need to set the screen lock and the SIM PIN once each.

Benefit

Without a SIM PIN, a finder can easily move your SIM card to another phone, receive verification codes, and reset all your accounts. With a PIN in place, that entire process is prevented, keeping your accounts safe even if your phone is lost.

Note

You can set the SIM PIN under “SIM card lock” in your phone settings. The default factory codes are usually 1234 or 0000. If you enter the wrong code three times in a row, you’ll need the PUK code provided by your carrier to unlock it. After setting the PIN, be sure to write it down somewhere safe.

The order of actions matters more than speed. First, block the SIM card to cut off access to verification codes. Next, remotely lock the phone. Then, use a computer to change your email and payment passwords. After that, file a police report to obtain a receipt. Finally, freeze your bank cards as needed. Even if you’re using someone else’s phone, you can still call your carrier to block the SIM card.

Cost

No cost involved. Completing all steps takes just a few minutes.

Benefit

Following the correct sequence is more important than acting quickly. Step one is blocking the SIM card, which severs the main channel for verification codes. Step two involves remotely locking the phone and erasing all its contents. Step three requires changing your email and payment passwords from a computer. Step four is filing a police report to get a receipt. Finally, freeze your bank cards if necessary. The Federal Communications Commission also advises that even if you believe you merely misplaced your phone, you should still remotely lock it. If it’s stolen, file a police report immediately, providing the phone’s model and IMEI number, and inform your carrier right away.

Note

Save the customer service numbers for all three major carriers in advance: China Mobile at 10086, China Unicom at 10010, and China Telecom at 10000. Also note the city where you registered your phone number, as customer service agents will ask for this information. You can still call carrier hotlines from someone else’s phone to block your SIM card.

If someone fraudulently uses your card, you don’t have to prove “this wasn’t me.” Instead, it’s the bank’s duty to prove the transaction was made by you. If they can’t, they must compensate you. This only applies if you report and freeze the card right away. Delaying this step means you’ll bear any additional losses that occur afterward.

Cost

No cost at all. As soon as you notice anything suspicious on your card statements, immediately report it and freeze the card. Keep all records: police reports, freeze confirmations, and transaction notifications from the bank. If the card is still in your possession, make a small inquiry or deposit nearby to create a record proving you had the card with you at the time of the fraud. The hardest part is resisting the urge to argue with customer service first — always freeze the card first.

Benefit

Supreme Court rulings clearly define who must provide evidence. If you claim the transaction resulted from counterfeit card fraud or online fraud, you must first gather proof — such as official legal documents, records showing where the card was physically located at the time, transaction logs, notifications, police reports, and freeze confirmations. Conversely, if the issuing bank or any third‑party payment service insists the transaction was authorized by you, they must produce evidence to support that claim. If, after you notify the bank, it fails to verify the transaction promptly or to preserve transaction records and surveillance footage, the bank bears the consequences of lacking proof. Once proven, debit‑card holders may demand full reimbursement of stolen funds plus compensation for any losses; credit‑card users may request a refund of all unauthorized charges, interest, and penalties, and courts will reject any demand that the cardholder repay those amounts. You may also ask the bank to promptly remove any resulting negative credit entries (effective 25 May 2021).

Note

There are two situations where you remain liable. First, if you fail to protect your card, PIN, or verification codes — in other words, if you neglect your duty to safeguard them — you’ll bear part of the loss. Keep your PIN secret and never share verification codes (see Item 1; two‑factor authentication via phone alerts is preferred). Second, if you delay reporting and freezing the card, any extra losses incurred afterward are your responsibility. Hence, the very first step is always to freeze the card — don’t waste time arguing with customer service first. These rules also apply to third‑party payment services. If such a service advertises “immediate compensation” with clear terms, you may demand payment from them. If you were tricked into transferring money, that falls under a separate procedure; see Item 8.2: call 110 or 96110 immediately to request a stop‑payment order.

“Logged-in devices” refer to the phones and computers that can still access your account right now. Account thieves often lie low for a while before making their move. If you see any unfamiliar devices on the list, or third-party apps you no longer use still linked to your account, log out from all devices and change your password right away.

Cost

No cost at all. It only takes a few minutes each time. The hard part is that there’s no reminder — you have to remember to do it yourself.

Benefit

Account theft rarely happens instantly — attackers usually spend some time lurking first. The list of logged-in devices shows all phones and computers currently able to access your account, while the list of authorized apps shows all third-party services you’ve given permission to log in using your account. Any unknown devices or unused third-party apps on these lists are the easiest clues to spot.

Note

This feature is available in WeChat, Alipay, email accounts, Apple ID, and Android accounts. If you spot any unfamiliar devices, simply log out from all devices and change your password.

Apps request your data. If that data isn’t strictly necessary to deliver the service, the app can’t deny you access just because you refuse to share it. It may only collect what it actually needs. For instance, a map app needs your location, but a flashlight app has no business asking for your contacts list.

Cost

No cost involved. The hard part is resisting the urge to tap “Allow all.”

Benefit

Two key legal points apply here. First, providers may not deny products or services on the grounds that a user hasn’t consented or has withdrawn consent — unless processing that data is genuinely essential to delivering the service. Second, data collection must stay limited to what’s absolutely required for the intended purpose; only the minimal amount needed may be gathered.

Note

The deciding factor is simple: is this data truly essential to providing the service? Location data is essential for a map app, but contact lists aren’t needed for a flashlight app. After installing an app, head to your phone’s settings under app permissions and turn off any nonessential permissions. Grant access only when you genuinely need them, and even then, limit it to a one-time permission.

You have the right to demand that a company let you view, copy, correct, and delete your personal information. When a service is discontinued, its retention period expires, or you withdraw consent, the company is obligated to delete that data on its own. If it refuses your request, it must provide a valid reason; otherwise, you can take it to court. Deactivating an account and deleting personal information are two separate actions — after deactivating, you must separately request deletion.

Cost

There is no cost involved. Only if the company drags its feet do you need to file a complaint or sue. A lawsuit typically takes several months to resolve, and you must pay legal fees yourself. Therefore, filing a complaint first is the more cost-effective option. The difficult part is having to repeatedly follow up when the company delays action.

Benefit

There are several situations in which a company must proactively delete personal information: when a service is discontinued, when the agreed retention period ends, when you withdraw consent, or when the original purpose of data collection has been fulfilled. If it fails to do so, you can demand deletion. Should it deny your rights without justification, you may file a lawsuit.

Note

Deactivating an account and deleting personal information are distinct processes; after deactivating, you must separately request deletion. Before switching phones or selling an old device, make sure to log out of all accounts, unlink them, and then perform a factory reset. The law grants you a right to deletion after the fact — it cannot retrieve data that has already been leaked.

As long as any other method can achieve the same result, a service provider cannot force you to use facial recognition. If you decline facial recognition, they must offer alternatives such as a card swipe, password entry, or ID verification. They also cannot threaten that “the service won’t be provided” if you refuse. Installing facial recognition devices in hotel rooms, public showers, changing rooms, or restrooms is strictly prohibited.

Cost

No cost involved. When asked to use facial recognition, simply ask, “Are there any other verification methods available?” If they claim none exist, demand they provide alternatives. The challenge lies in actually voicing this question on the spot.

Benefit

The Administrative Measures for the Safe Use of Facial Recognition Technology clearly state: “Where other non-facial recognition technologies can achieve the same purpose or meet equivalent operational requirements, facial recognition must not be used as the sole verification method. If an individual declines facial recognition for identity verification, other reasonable and convenient alternatives must be provided.” The measures further stipulate: “No organization or individual may mislead, deceive, or coerce individuals into accepting facial recognition for identity verification under the pretext of service delivery or improved quality.” Consent to use facial recognition must be “freely, explicitly, and separately given after full disclosure” — meaning you must be asked specifically about this and must agree independently. You retain the right to withdraw consent, and service providers must offer an easy way to do so. For minors under 14, parental or guardian consent is mandatory. In public spaces, facial recognition devices may only be installed if “necessary for public safety” and must display prominent warning signs. Their use inside private areas such as hotel rooms, showers, changing rooms, or restrooms is forbidden. Facial data must be stored locally on devices and must not be transmitted over the internet, except where permitted by law or with explicit consent (effective nationwide as of June 1, 2025).

Note

Common scenarios include residential building access systems, rental platforms, gyms, and hotels requesting facial data. When they claim “the system only supports facial recognition,” quote the exact wording from the regulations: “Where other non-facial recognition technologies can achieve the same purpose or meet equivalent operational requirements, facial recognition must not be used as the sole verification method.” Then demand alternative verification methods such as card swipes, passwords, or ID checks. If they still refuse, report them to local internet regulatory authorities. Certain financial and government services may have separate rules — follow those instead. Unlike passwords, facial data cannot be changed after a breach, so it demands greater caution. Organizations storing facial data on behalf of 100,000+ individuals must register with provincial or higher-level internet regulators within 30 days; this registration status can help you assess their legitimacy. Your rights to access, correct, or delete your personal data are covered in item 8.

An intermediary proxy sits directly between you and the model provider: it can observe, intercept, and modify everything you send and receive. In an empirical study evaluating over 400 proxy stations, 9 injected malicious code into model responses, and 17 actively hijacked intentionally seeded cloud service credentials. If you allow AI agents to execute commands locally on your machine, a single tampered command is enough to compromise full system control.

Cost

Direct official API access is typically more expensive than third-party relay proxies, and recharging balances can be less convenient. The friction lies in the temptation: relay proxies are cheap and provide access to multiple foundational models through a single endpoint.

Benefit

In June 2026, the Ministry of State Security issued a cybersecurity advisory warning that unverified third-party proxy relays retain submitted user data on remote servers, intercept proprietary code, or resell private datasets to other model providers for training. Some proxies conceal backdoors, injecting malicious payloads into user devices to harvest credentials and install remote administration trojans. The advisory strongly recommends using direct official API connections or officially licensed platforms while avoiding unlicensed, unverified proxies. Sensitive data and project documentation should be sanitized and desensitized before transmission, and API keys must be rotated regularly. If abnormal billing, unexplained bans, or data anomalies occur, discontinue service immediately, revoke keys, scan for malware, and preserve evidence. A 2026 empirical study by researchers at UC Santa Barbara and collaborator institutions evaluated 28 commercial relay services purchased across online storefronts and 400 public free proxies. Results showed that 1 paid service and 8 free proxies injected malicious code into returned tool-call outputs (system commands instructed by the AI to run on local machines, such as package installations). Furthermore, 2 services strategically timed their attacks, selectively targeting fully autonomous agent execution sessions. Seventeen proxies actively abused intentionally placed Amazon Web Services (AWS) credentials, and 1 drained test funds from an Ethereum test wallet (loss under $50). The study demonstrated subtle, stealthy tampering techniques: for instance, replacing standard packages like `requests` with typosquatted dependencies like `reqeusts` in command payloads, which easily escapes visual inspection.

Note

Rated Grade B because it relies on a single empirical preprint prior to peer-reviewed publication. The majority of evaluated relays were free public endpoints, with only 28 commercial services tested, precluding an exact statistical percentage of compromised market share. Some media reports mistakenly exaggerated the test wallet theft to $500,000; the actual loss reported in the paper was under $50. Benefit is rated medium due to the severity of credential leaks and device takeover risks, though individual financial losses vary. If you have previously routed sensitive requests through unknown proxies, immediately revoke and regenerate affected API keys with the official model provider, as well as any exposed cloud provider and code repository access tokens. When routing through third-party proxies, never grant AI agents unreviewed autonomous command execution—manually inspect every shell command before confirmation. For criminal liabilities associated with operating unauthorized proxy relays, see Chapter 11, Rule 19.

Criminal fraudsters frequently use stolen or forged ID information to open fraudulent SIM cards and bank accounts, often leaving victims completely unaware until police freeze their accounts or credit scores drop. Free official portals allow you to query how many SIM cards are registered to your ID card, which platforms link to your phone number, and all UnionPay debit and credit cards opened in your name. If you discover unrecognized accounts, contact the telecom carrier or bank immediately to investigate and cancel them.

Cost

Zero financial cost. Check SIM cards via the "MIIT Micro-Report" official WeChat account or the "One ID All Queries" mini-program on Alipay. Audit bank cards via the "One-Click Card Query" feature within the China UnionPay (UnionPay QuickPass) app. Each query takes only a few minutes, with results dispatched via SMS within 1 to 2 days. The difficulty is self-discipline—remembering an unprompted annual security audit.

Benefit

The Anti-Telecom and Online Fraud Law mandates that telecommunications authorities provide convenient channels for citizens to query SIM cards registered under their identities, and the People's Bank of China must ensure convenient verification tools for bank accounts and payment accounts. The Ministry of Industry and Information Technology (MIIT) launched the national "One ID All Queries" mobile card verification portal on September 14, 2021. Entering your citizen ID number returns total registered SIM card counts across all three major telecom operators. The service was deployed because nationwide anti-fraud crackdowns revealed that vast numbers of fraud SIMs were registered under innocent citizens whose identities had been misappropriated, inflicting reputational and credit harm. Verification results arrive within 48 hours via SMS from 10699000; discrepancies can be audited at operator service centers to verify, unbundle, freeze, or terminate fraudulent lines. In July 2022, MIIT introduced "One ID All Queries 2.0," which queries the total number of major internet platform accounts (including WeChat, Alipay, Baidu, Kuaishou, Douyin, JD, Meituan) bound to a phone number. For bank accounts, China UnionPay expanded "One-Click Card Query" nationwide across all provinces on June 29, 2022. Users select banks, complete biometric authentication, and receive a comprehensive, desensitized account report within 24 hours (data is automatically purged after 7 days).

Note

"One-Click Card Query" is limited to UnionPay cards. Cards without a registered mobile number or with expired identity filings may not appear in the automated query; individual bank records remain definitive. Checking credit reports for unauthorized loans and credit card lines is detailed in Chapter 8, Rule 9. For phone numbers showing extensive platform bindings, unlink them before canceling the phone number (see Chapter 14, Rule 12). Lending or selling your own SIM and bank cards constitutes a criminal offense (see Chapter 8, Rule 8). Evidence Grade C reflects reliance on official government regulatory service bulletins rather than controlled trials quantifying saved financial loss. Benefit magnitude is categorized as Moderate. Beneficiary is yourself.

Once a mobile phone number is cancelled, telecommunications carriers are legally permitted to reissue that recycled number to a new subscriber after just 90 days. If your old accounts remain linked to that number, SMS two-factor verification codes will route directly to the new subscriber's handset, potentially allowing them to log into your accounts. Always migrate critical payment apps, digital wallets, and bank records before disconnecting your number.

Cost

Zero financial outlay. Requires migrating accounts individually to your new number, and updating bank-registered mobile numbers via banking apps or physical branches. Accounts with extensive bindings take 1 to 2 hours. The difficulty is remembering rarely used legacy services.

Benefit

National Telecommunications Service Specifications mandate that the minimum quarantine freeze period for mobile phone numbers is 90 days (measured from cancellation to reissue), after which numbers may be reassigned to the public pool. MIIT's Q1 2025 Telecommunications Service Quality Bulletin highlighted the carrier "Recycled Number Renewal" feature within operator apps, enabling new subscribers to unbind accounts registered by previous owners prior to line activation. The Q2 2026 bulletin noted that this service covered 258 mainstream internet applications with over 850 million unbinding requests processed. The necessity of new subscribers having to unbind past accounts confirms that legacy accounts frequently remain bound to recycled numbers. In 2024 interviews with People's Posts and Telecom, carrier customer service representatives confirmed that new number owners can log into legacy accounts via SMS verification codes if previous holders failed to unbind them, strongly advising subscribers to unlink WeChat, Alipay, and bank registration numbers prior to number cancellation.

Note

First use "One ID All Queries 2.0" to audit how many platforms are tied to your old number (see Chapter 14, Rule 11). Update high-risk financial and payment accounts first, then social platforms, and delete unused legacy accounts. After migrating accounts, maintain the old number on a minimal maintenance plan for 1 to 2 months to catch any overlooked SMS verification prompts. Managing unauthorized device logins is covered in Chapter 14, Rule 6. Sanitizing old phones and performing factory resets prior to sale is addressed in Chapter 14, Rule 8 notes. Graded Evidence Grade C due to qualitative operational advisories from carriers and regulators. Benefit is categorized as Moderate. Beneficiary is yourself.