Why Chinese tech companies fear the "Wool-Pulling Party"

Pinduoduo hit by a gang known for tormenting tech companies

E-commerce

Masha Borak

Published: 9:06pm, 22 Jan, 2019

Why you can trust SCMP

This article originally appeared on ABACUS

An ecommerce platform in China has just lost around US$1.4 million thanks to a nimble group of users with an unusual name: The Wool-Pulling Party.

Social ecommerce platform Pinduoduo realized it got "fleeced" last Sunday through a loophole which enabled users to get unlimited online coupons worth approximately US$15 each. The company said it fixed the problem and reported the incident.

But Pinduoduo is far from the only online platform that has fallen victim to this group. In fact, these kind of schemes have become widespread in China, where many tech companies compete for users by handing out cash incentives.

The Chinese platform known for fake products now has a clone

The term Wool-Pulling Party refers to users which operate in a legal grey area, taking advantage of these promotions to raid platforms for gift coupons and cash incentives. Sometimes they're as simple as that, users piling on to a too-good-to-be-true deal, while at other times they use far more nefarious means that may be illegal.

The term is said to originate in a popular sketch performed during the 1999 CCTV Chinese New Year Gala show. But the sketch is actually quite grim.

An old village woman (played by popular Chinese sitcom actress Song Dandan) tells how she stole wool from collectively owned sheep during Mao’s era to make her husband’s sweater, and was consequently subjected to a struggle session, a form of public humiliation and torture not uncommon at the time.

“You were undermining the foundations of socialism!” exclaims the host.

“Yes, I was convicted of fleecing socialist wool.” (drum roll)

Reminiscing “the good old days”... or not. Screenshot from the Yesterday, Today, Tomorrow sketch aired during CCTV’s 1999 New Year Gala. (Picture: iQiyi)

These days, the fleecing is done by the young and tech savvy. The Wool-Pulling Party usually gathers in online groups to exchange tips on who to shave off next. Usually, it's the new fast-rising companies that draw them.

One well-known example involves bike sharing company Ofo, which burst into the market with a shower of cash incentives to get users to try out their service. The ruse uncovered in April 2017 included rooting a mobile phone, installing virtual GPS location software, and “unlocking” a bike from the Ofo app -- no cycling needed. Users could earn a couple of hundred dollars a day by targeting bikes with coupons without actually ever leaving their rooms.

The Wool-Pulling Party is also known to target O2O (Online-to-Offline) businesses that give out online coupons as well as online financial platforms known as P2P (peer-to-peer) lenders. Many of these P2P platforms offered registration and authentication incentives, cash-backs or rebates in order to draw lenders and investors which were then diligently exploited by the Wool-Pullers.

According to Men Meizi, Chief Researcher of Tencent Network Security and Crime Research, the Wool-Pulling Party often relies on similar methods as click-farms. False or illegally acquired ID information is registered in large batches, bound with mobile phone numbers obtained through various murky channels. This enables users to register on platforms illegally, since Chinese platforms are required by law to ensure real-name authentication.

"Almost all the Internet platforms we use in our daily life, such as ecommerce, games, life services, social networking and so on, cannot avoid the emergence of malicious registration." Men told state-run news agency Xinhua in a recent interview.

Some of this fleecing isn't even done by humans – it’s done by bots. A report from Chinese cybersecurity company Qihoo 360 showed that many of the discounts offered during China’s biggest shopping festival Singles’ Day were snatched up by machines instead of actual shoppers. In October alone, Qihoo 360 detected more than 67 million Wool-Pulling Party devices used to imitate actual users.

Singles’ Day, the shopping event that makes Black Friday look like a yard sale

In many cases, online platforms have no choice but to accept that they have been stripped of their money. On New Year's Day 2018, music streaming site Tencent Music launched a subscription promotion -- but due to a server bug, the platform enabled users to get a subscription for a mere 2 cents instead of the promotional price of US$2.60. The vulnerability attracted some 390,000 users. Tencent had no choice but to accept their mistake, reportedly paying US$7.6 million (51.8 million yuan) for the blunder.

However, Pinduoduo said that this time it will not let it slide. According to the ecommerce platform, the group who exploited the vulnerability was well organized: They used vouchers that were already expired and turned them into QR codes in order to spread them faster and make it seem like it was done by ordinary users. The Shanghai police are now investigating the Wool-pullers for online fraud, according to local media.

For more insights into China tech, sign up for our tech newsletters, subscribe to our Inside China Tech podcast, and download the comprehensive 2019 China Internet Report. Also roam China Tech City, an award-winning interactive digital map at our sister site Abacus.

Post