| | | Effective PR

Singles Day: how WePay, Taobao / Xianyu and AliPay facilitate fraud

Editorial Staff

If you are planning to spend money for the Alibaba-inspired "Singles Day" on 11 November, be warned. Fraud happens and when it does, you have little or no recourse from any of the companies behind the scheme, and little or no help to try to recover your losses. But even more than that, the case shows how mobile payments are inherently risky and are ready channels for fraudsters to use.

When Miss B, a resident of Shanghai, posted an advertisement on Xianyu, the Alibaba-owned equivalent of e-Bay, and a division of Taobao, she was delighted to receive a response almost immediately. Someone wanted to buy her barely-worn designer shoes for the asking price. Then the fraud started and Taobao / Xianyu, WePay and AliPay have failed to act, leaving her substantially out of pocket when, had they...

The fraudster(s) acted quickly: using fake accounts within the Xianyu system, the fake buyer said that (s)he had sent the money to the seller then, minutes later, the fake buyer sent another message saying that she had heard from Xianyu's customer service department that the payment had been received but could not be processed due to a "payment error." It had therefore been returned, she said. She told Miss B that Customer Service would contact her. Very shortly after that, Miss B received a message that appeared to come from the customer service department using the ID liaoyixinlyx. That, Miss B would later learn, was a fake account within the Xianyu system, sending messages within the system and therefore having credibility.

Adopting a variation of the "account verification" system adopted by, inter alia, PayPal in which a small deposit is made to a new customer's account, the fake customer services officer said that, as Miss B was a new user, a payment would be required to be made through AliPay to the company and that money would be returned to the account within three hours. Although bemused, Miss B thought this sounded feasible and agreed to make the payment. The amount requested was RMB3,000 (approx GBP300). The fake CS sent to her a QR code and, using AliPay on her mobile phone, Miss B made the payment.

Miss B told the buyer that the process had been completed and to re-send the money. Again, the buyer reported that the transaction had failed. Miss B contacted "customer service" only to be told that the reason was that the goods cost more than RMB3,000 and because of that they count as "luxury goods." A further RMB5,000 would need to be paid to open the authority to trade in such high value goods. Again, this is almost logical and so, again via a QR code, Miss B paid the additional sum.

A short while later, the buyer said she had mistakenly paid twice and asked Miss B to refund one of the payments. Miss B asked for proof and was provided with a fake screenshot showing both amounts. Miss B sent this to what she believed was customer service and was told that the record was true and that the company would not authorise any activity on Miss B's account (including to refund the additional payment) until Miss B effected a refund to the buyer. Then, once the money had been paid, the transactions would be processed.

By this time, Miss B was completely confused. All this had happened within a very short time. Believing herself to be stuck in a customer-service hell, she did as she was told. This time, the QR code was sent by e-mail and payment was made by WePay.

It was late and Miss B had to get up early the next day for work. She went to bed and then, the next evening, checked her account, found no money and found that both of the accounts she had dealt with the evening before had been closed or had blocked her. At that point she realised what had happened and immediately contacted Xianyu / Taobao and Alipay. They said it was a fraud but there was nothing they could do.

We, using various means, have tried to contact all the companies concerned but have had absolutely no response from any of them.

Here, the problem is simple: the platform allows fake accounts and does not offer fraud protection to sellers. Payment via QR code is inherently risky: the sender cannot see the account information behind the code. Therefore, Miss B would have no idea that the QR code did not relate to accounts for e.g. Xianyu.

WePay and AliPay are both making significant efforts to expand their global reach yet it appears that their fraud risk management and compensation schemes are absent or rudimentary.

Using them, and using the sales platforms mentioned, is clearly a risk that many would want to avoid.