Defining crimes in facial-recognition payment
A man scans his face in front of a camera to pick up his parcel from a storage locker in Shanghai. Photo: CFP
Fingerprint payment and facial-recognition payment (FRP) are both products of biometric technology combined with mobile payment technology. In comparison, as a contactless payment technology, FRP is more promising and more widely preferred by third-party payment platforms and financial institutions. FRP has been earmarked as the next payment technology to be popularized after QR code payment.
Meanwhile, criminal acts related to FRP are also rising. Due to lack of laws, regulations, and judicial interpretations for this new payment technology, judiciary organs have made varied conclusions when trying to determine the nature of this new type of tort. Most legal specialists define it as an act of theft, whilst others see it as a fraudulent act, similar to credit card fraud. Views on the nature of criminal acts related to FRP vary.
Constitutive acts
Essentially, FRP involves two acts: illegally obtaining the data of another person’s facial features and forging facial identification.
To unify understandings of this criminal act, the Beijing Internet Court published the White Paper on the Application of Internet Technology in Judicial Practice (2019), which defined Facial Recognition Technology (FRT) as a biometric identification technology capable of identifying a person by matching their facial features against a database of faces. When applied to payment technology, FRT allows consumers to pay instantly by scanning their faces.
Based on different standards, scholars have categorized several forms of FRP-related crimes into different categories. For example, some scholars divide criminal acts into two types based on specific behaviors: the first type is a face forgery attack, which refers to using AI face swapping technology, high-resolution 3D face models, or printed photographs of other people to bypass the facial biometrics and illegally obtain others’ money. The second type of FRP crime involves secretly, publicly, or violently scanning another person’s face so as to acquire their money.
Although unlawful acts associated with FRP can be accomplished in various ways, they essentially constitute two specific behaviors. The first act is illegally obtaining other people’s facial recognition data. That is to say, the actor accesses others’ facial recognition data via either face forgery or forcing others to scan their faces. The second behavior refers to actual transactions, meaning that once the actor has illegally acquired others’ face data, he/she can then use the data to go through the FRP process and illegally obtain their money.
Illegally obtaining biometric data
Essentially, unauthorized access to others’ facial recognition data is equivalent to illegally obtaining others’ credit card account number and personal identification number (PIN). It is not a financial criminal act.
The FRT simplified the complicated process of traditional payment—inputting an account number and PIN—into a simpler and faster act of face scanning, thereby increasing payment efficiency. Therefore, scanning one’s face when making a payment using FRT is the same as typing in one’s account number and PIN.
As such, illegally obtaining others’ facial recognition data prior to conducting a financial criminal act is actually the same as illegally obtaining others’ credit card account number and PIN, which does not constitute an actual financial crime, since it has not yet infringed upon others’ property rights and interests.
This is because the credit card number and PIN have no actual economic value. They are merely a pair of numeric combinations. Unlike money, or other objects with actual use value or economic value, they are not property, therefore not the target of financial crimes. In other words, in itself, illegally obtaining others’ credit card number and PIN does not impose direct material infringement upon others’ property right and interests.
In addition, obtaining others’ credit card number and PIN through illegal means does not mean that one has illegally acquired money stored on the credit card. The judiciary interpretation of larceny cases, in a law published by the Supreme People’s Court in 1997, stated that the judicial determination for the value of money stolen in a case of “stealing and using other’s credit card” should not be based on the amount stored on the credit card, but on the actual amount of money that has been stolen.
It is clear that judiciary interpretations should maintain that illegal obtainment of someone else’s credit card number and PIN does not mean that one has illegally obtained the deposit stored within the account. Whether or not someone has illegally obtained the amount stored in the account and how much the actor has illegally gained should be determined based on whether or not they conducted the actual financial criminal act.
Credit card fraud
In essence, FRP fraud is a criminal act that infringes upon others’ property by making use of FRT in an illegal way. It can be categorized as “fraudulent use of a credit card” under credit card fraud.
Undeniably, third party payments differ from credit card payments in their issuing bodies’ legal attributes. Nevertheless, the two share much in common, in terms of their functions and usages.
Meanwhile, financial laws and regulations categorized third-party payment platforms as non-financial institutions in a bid to maintain China’s financial market order. Whereas criminal law, which exists mainly to regulate crimes, should never invent different charges for two financial criminal acts of the same nature. This would go against the basic principle of criminal law.
Thus, seeing third-party payment as one of the many credit card payment methods not only suits the features of a credit card, but also conforms with the fundamental principle of criminal law in China. It also helps judiciary authorities determine the nature of various new-type financial criminal acts.
Furthermore, FRP, either through third-party payment software or Apps offering mobile banking services, is no different from traditional mobile payments. They still belong in the category of using a credit card without using the physical form of the card. Therefore, FRP using third-party software, mobile banking APPs, and other FRP facilities, all qualify as payment using credit cards.
Therefore, face forgery in illegal financial crimes conducted via FRP should be evaluated as “fraudulent use of others’ credit card” under credit card fraud. Since face forgery is the core criminal behavior of financial crimes associated with FRP, its nature determines the nature of the financial crime. Thus, it is reasonable to define the crime as a credit card fraud.
Robbery
Forcing others to access their account using FRP constitutes robbery. Unlike the crimes of larceny and swindling that both target the ownership of public and private properties, the crime of robbery has a different criminal object, i.e., civilians’ bodily rights. Robbery infringes upon complicated objects.
As criminal law has set heavier statutory sentences for the crime of robbery, based on the principle of implicated offenses, fraudulent use of others’ credit card after robbery is usually determined to be robbery. Similarly, using violence, force, or other methods to force victims into FRP, to acquire their property, should also be considered robbery.
In summary, financial crimes associated with FRP are essentially compound behaviors that consist of illegally obtaining others’ facial recognition data and going through the payment process using illegal methods.
Specifically, unauthorized access to others’ facial recognition data is basically the same as illegally obtaining others’ credit card account number and PIN, neither of which should be considered a financial crime. Illegal FRP behaviors are the primary actions linked to FRP financial crimes, and these behaviors should be considered “fraudulent use of others’ credit card” under the category of credit card fraud. Therefore, generally speaking, FRP financial crimes should be defined as credit card fraud, except when the actor forces another into FRP, which should be defined as a robbery, because the act infringes upon others’ financial, as well as bodily, rights and interests.
Yao Jingjun is from the Criminal Justice College of East China University of Political Science and Law.
Edited by WENG RONG