Chinese government-run facial recognition system hacked by tax fraudsters: report
- A group of tax scammers hacked a government-run identity verification system to fake tax invoices
- The fake tax invoices from the criminal group were valued at US$76.2 million
That development, however, has made cybersecurity a major issue in the world’s second-largest economy, where a group of tax scammers has been caught hacking a government-run facial recognition system to fake tax invoices and make millions of yuan in the process, according to a report by the Xinhua Daily Telegraph. Invoices issued by the State Taxation Administration are used to track payments and help crack down on tax evasion.
Prosecutors in Shanghai said a criminal group duped that platform’s identity verification system by using manipulated personal information and high-definition photographs, which were bought from an online black market, so its registered shell company can issue fake tax invoices to clients, according to the report published on Tuesday.
The Shanghai People’s Procuratorate in the city’s Hongkou District indicated that the fake tax invoices issued by the criminal group were valued at 500 million yuan (US$76.2 million), the report said. A notice posted on the Shanghai prosecutors’ official WeChat account from January this year said that a duo surnamed Wu and Zhou were prosecuted for the crime. It said the duo had been operating since 2018.
The suspects duped the government-run platform’s facial recognition system by manipulating the illegally obtained high-definition photos with an app to create a video, making it seem like the faces were nodding, shaking, blinking and opening their mouths.
“After obtaining the videos, we used a special mobile phone to hijack its camera,” an unnamed suspect was quoted saying in the report. “During the facial authentication process, the mobile camera would not start and the system would receive the pre-made video. The system accepted that I was in front of the camera, so I passed the certification.”
To build a ‘Digital China’, the country must first tackle its black market for personal information
The Xinhua Daily Telegraph investigation found that the cost of hacking facial recognition systems for illegal gain is low. Image-manipulation apps – including Huo Zhaopian, Fangsong Huanlian and Ni Wo Dang Nian, also known as Remini Photo Enhancer – are readily available for download, while the special mobile phones used to hijack cameras can be bought for 1,650 yuan.
Online services to crack facial recognition are also available, with prices ranging from 30 to 250 yuan. These services can tackle facial recognitions systems – biometric computer applications that identify a person based on a database of digital images – used on a range of apps and government platforms.
The situation reinforces China’s reputation as one of the worst countries at protecting biometric data. Many of China’s 1.4 billion population are already online, but the country is known for lax controls over the collection, storage and use of individual digital data.
00:59
China’s facial recognition technology identifies people wearing masks amid the Covid-19 epidemic
In response to privacy concerns, Beijing has stepped up to rein in the collection and use of personal data by mobile apps. A new regulation on necessary personal information for common types of mobile internet applications will take effect on May 1. It also covers the basic functions and services for 39 app categories, including messaging, online shopping, payments, ride hailing, short video, live stream and mobile games.
The government has also issued a draft legislation, the Personal Information Protection Law, aimed at preventing private data leaks and abuses. It proposes to impose fines of up to 50 million yuan, or 5 per cent of a company’s annual revenue, for such offences.
