Summary of the Incident
This is a typical case of an innocent user being deceived due to a combination of platform security vulnerabilities: Ms. Qi, a user from Guangzhou, had never clicked on any fraudulent links or shared her password, and she had even stopped using an old phone number she had cancelled two years ago. Yet, within two months, someone used this old, reactivated phone number to log into her Hello app and made 109 transactions totaling over 6,500 yuan, all within the app’s 200-yuan password-free spending limit. After the incident, Hello only offered a 200-yuan “experience bonus” as compensation and shifted all the responsibility onto the thief, urging the user to report the crime herself. Alipay, which is the actual payment processor and also Hello’s largest shareholder, remained completely silent. Both companies tried to shift the blame onto each other, ultimately shifting all the costs of the loss onto the innocent user.
---
Detailed Analysis of the Incident
The Entire Process of the Theft
The whole process is incredibly absurd, akin to “you throw away your old house key, and a passerby just walks in and moves your stuff.”
Many people might wonder how the thief was able to log into Ms. Qi’s Hello account. There was no use of any advanced technology; it was all a straightforward violation of the platform’s rules:
The old phone number, which Ms. Qi had cancelled two years ago, was sold to a new user after the 90-day freeze period required by the operator. This new user (or the thief) simply needed to follow the “recover password” process on the Hello app, receive a verification code via text message, and then take control of the account—without any need for facial recognition, ID verification, or even checking the original account owner’s personal information.
The thief was also very clever: they started with small transactions of around 10 yuan to test the payment process. Once they confirmed that the system would allow the transactions, they made each payment exactly 199 yuan, just one yuan below the 200-yuan limit set by Ms. Qi. This way, they avoided the Alipay’s transaction risk controls. If Ms. Qi hadn’t received a promotional text message from China Merchants Bank, she would never have noticed the unauthorized transactions.
Each Party Has Its Own “Exemption Reason”
The most baffling part is that no party clearly violated any rules, and each could cite their own compliance policies, yet the user ended up losing thousands of yuan:
- The operator argued: “I followed the ‘Telecommunications Service Specifications’ by freezing the cancelled account for 90 days before selling it; I have no authority to unbind it from hundreds of internet platforms.”
- Hello claimed: “Our platform policy allows account rebinding with just a verification code. Whoever owns the phone number is considered the account owner; we don’t know if the number was previously used by someone else.”
- Alipay stated: “The password-free payment agreement you signed was linked to your Hello account, not to the phone number. Since you cancelled the phone number but didn’t cancel the agreement, we had the right to deduct the money according to the terms.”
- Alipay’s risk control added: “Transactions from authorized merchants are considered low-risk, so we didn’t need to send you notifications for small amounts.”
Each party’s rules seemed reasonable on their own, but together they created a virtually unobstructed path for the thief.
Hello’s Compensation of Only 200 Yuan
Hello’s offer of a 200-yuan compensation is not generous; it’s actually a calculated move, recognizing that most people find it too troublesome to pursue further action.
Many people criticize Hello for being stingy, offering only 200 yuan for a loss of over 6,000 yuan. This is a standard practice the company has used for years. In previous cases in Shaanxi and Shanghai, Hello compensated users between 50 and 200 yuan. Essentially, the company calculated that for most people, the hassle of pursuing legal action (which could take up to 45 days through 12315 or even longer through police and legal processes, potentially costing more than the compensation) would be too much. As a result, 90% of the affected users simply accepted the 200 yuan.
By replacing “full compensation” with “we’ll help you recover the loss from the thief,” Hello shifted the civil dispute into a criminal case, effectively shifting all the costs onto the user without incurring any additional expenses. This isn’t Hello’s first security issue; its shared electric bike service had also been criticized by CCTV’s 315 program for unauthorized charges, and the platform’s system has not been updated to synchronize phone number status for several years.
The Two Companies Shifting Blame
Most people think Hello and Alipay are separate companies, so it’s understandable for them to blame each other when something goes wrong. However, from a capital perspective, Alipay’s parent company, Ant Group, holds a 36.3% stake in Hello, making this a matter within their own ecosystem.
Alipay has long promoted the slogan “If you dare to pay, we dare to compensate,” promising full coverage for password-free transactions. But when it comes to issues involving their own users, they simply remain silent. More absurdly, according to central bank regulations and court rulings, the burden of proof in such cases lies with the platform. If the platform cannot prove that the user leaked information or made the fraudulent transactions themselves, they must compensate the user in full. Since the platform holds all the evidence (transaction logs, login IP addresses, device fingerprints, etc.), the user has no way to fight back.
Three Things Ordinary People Can Do to Avoid Becoming Victims
This type of theft is now very common. You can avoid 99% of the risk by taking these three steps:
1. Before cancelling an old phone number, manually unbind all apps that were previously linked to that number, especially those for ridesharing, food delivery, and video subscriptions that offer password-free payment.
2. Turn off password-free payment on all platforms. If you need to keep using it for convenience, set the password-free limit to the lowest amount (10 or 20 yuan) to minimize potential losses.
3. If you encounter unauthorized charges, don’t waste time arguing with the platform’s customer service; instead, contact the national financial consumer complaint hotline (12363) and report the issue to the payment institution’s regulator. According to regulations, if the payment institution cannot prove that the loss was due to the user’s own actions, they must compensate in full—this is much more effective than dealing with the platform.