Persona Vault: AI Digital Identity Protection Service is Actually a Front for Reselling Biometric Data

Who Gets Targeted

The primary victims are ordinary internet users who experience strong anxiety regarding 'digital identity security' yet lack the technical discernment to evaluate risks. This includes young users who frequently use social platforms and online financial services, as well as middle-aged and elderly individuals worried about their faces or ID cards being stolen. They commonly possess a psychological desire for 'privacy protection,' which scammers reverse-engineer and exploit: first manufacturing identity leak panic, then promoting so-called 'AI-generated virtual identities' to replace real information, and ultimately prompting victims to voluntarily hand over their biometric data. Many victims routinely register accounts across multiple platforms, are accustomed to facial recognition verification or uploading ID cards, harbor a natural trust in terms like 'official partnership' and 'AI encryption,' and lack risk awareness regarding secondary data circulation. Once their information is collected, they often remain unaware until their accounts are impersonated or they become targets of focused fraud.

骗局怎么运作

• Step 1: Deploy anxiety-driven advertising. Using social media, short videos, and search engines, scammers push intimidating copy such as 'Your face is being abused' or 'Your ID card has entered the black market,' claiming to provide a free 'identity security check' portal. Users are lured into clicking through to a counterfeit official website or chatbot dialog page with the prompt 'Enter your mobile number to view your digital identity risk index,' which actually collects the mobile number and device fingerprint first.
• Step 2: Under the guise of 'AI digital identity protection,' users are asked to upload the front and back of their ID cards, a photo of themselves holding their ID card, a dynamic facial recognition video (including nodding, blinking, and other actions), and their mobile number. The service claims this data will be used by 'AI to generate an untraceable virtual avatar' to replace real information for online registration, emphasizing that data is 'never uploaded to any server' and 'processed locally,' allowing users to lower their guard and willingly hand over their biometric information.
• Step 3: The collected biometric information is bundled with real ID card photos and facial videos and sold by the 'set' on black markets or dark web forums. Buyers are typically criminal syndicates executing AI face-swapping account registration, online account laundering, or facial recognition bypasses. A packaged set containing dynamic facial videos can sell for hundreds to tens of thousands of RMB. Sales channels include Telegram groups, encrypted chat groups, and underground data trading platforms, with transactions settled in cryptocurrency.
• Step 4: AI is used to generate 'digital doubles' partially matching the victims' real names and ID numbers. These are used to batch-register accounts across multiple platforms, or synthesize videos via AI face-swapping to impersonate individuals for facial recognition verification, facilitating loan applications, shell company registrations, money laundering, and targeted telecom fraud, turning victims into unwitting links in a criminal chain.
• Step 5: Once victims discover identity impersonation, abnormal bank accounts, or receive scam calls, scammers have usually disappeared or deactivated customer service portals, with website domains frequently changing. Subsequent attempts may involve secondary fee collection under the guise of 'data breach emergency handling' or 'identity restoration services,' using scripts such as 'Your virtual avatar has been compromised; you must pay a security deposit to completely purge black market data,' repeatedly fleecing the same victim.

红旗信号（看到这些快跑）

• 🚩 Demanding the upload of photos holding an ID card, dynamic facial recognition videos, or nodding and blinking actions. No legitimate identity verification service will proactively request dynamic facial recognition videos to 'generate a virtual identity.'
• 🚩 Claiming that 'AI digital identities' or 'virtual avatars' can replace real ID documents for registration or verification, confusing the concepts of 'privacy protection' and 'identity forgery.'
• 🚩 Using 'free testing' and 'risk index' as bait to first solicit basic information like mobile numbers and ID numbers, and then progressively escalating requests to obtain biometric data.
• 🚩 Promising 'never uploaded to servers' and 'local encrypted processing,' while actually requiring users to submit data online via web pages or apps, making it impossible to verify whether data is retained or resold.
• 🚩 Websites lack genuine corporate registration information, customer service contact is limited to online chat or Telegram, and domain registration dates are short and frequently changing.
• 🚩 Packaging services with rhetoric such as 'official partnership,' 'Cyberspace Administration filing,' or 'Public Security authentication,' while failing to provide any verifiable qualification numbers or filing documents.

真实案例

• In September 2026, Hong Kong police busted a case involving the use of AI-generated fake ID cards for online account opening and money laundering, arresting 15 people. Modus operandi included collecting real ID card photos and facial videos to synthesize forged documents used to register multiple financial accounts to transfer illicit funds. Relevant reports were disclosed by on.cc.
• CCTV exposed an AI face-swapping black-market case where police seized over 50,000 dynamic facial videos containing actions like nodding and blinking. Criminals used these videos to impersonate individuals to register accounts, resulting in 14 arrests. Video sources included user-uploaded data collected under the guise of 'identity protection' and 'AI testing,' with reports reprinted by Sina News.
• The Taiwan Criminal Investigation Bureau cracked a scam syndicate dubbed a 'digital arsenal.' An engineer sold 160,000 sets of LINE accounts used for fraud, with involved amounts reaching hundreds of millions of New Taiwan Dollars. The accounts were linked to massive amounts of stolen personal identity information and biometric data. SET News publicly reported the case.
• US identity verification company Persona was accused of privacy risks in March 2026 due to code leaks. Its system collected user ID cards and selfie photos and executed 269 AI screenings. Although it did not involve direct reselling, security researchers criticized it as an 'invisible surveillance pipeline,' demonstrating that legitimate identity services can also become entry points for biometric data abuse. Both CN-SEC Chinese Net and Secure.com mentioned this incident.
• In February 2026, the US Department of Justice disclosed the case of the AI fake ID platform OnlyFake, where the platform operator pleaded guilty. The site used AI to generate and sell over 10,000 forged passports, driver's licenses, and other documents, primarily used by buyers to bypass KYC checks on cryptocurrency exchanges. An undercover FBI agent successfully purchased fake IDs, and the defendant faces up to 15 years in prison while agreeing to forfeit $1.2 million. (Source: [https://www.bleepingcomputer.com/news/security/ukrainian-man-pleads-to-running-ai-powered-fake-id-site/](https://www.bleepingcomputer.com/news/security/ukrainian-man-pleads-to-running-ai-powered-fake-id-site/))
• In February 2024, a Hong Kong employee of British engineering firm Arup attended a multi-person video call where participants included an AI deepfake-generated chief financial officer and other colleagues. Acting on instructions, the employee transferred a total of $25 million across 15 transactions. Hong Kong police later confirmed that all participants other than the victim were forged, and the case was publicly reported by media outlets like CNN. (Source: [https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html](https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html))

Official Stance

• On September 5, 2026, Hong Kong's on.cc reported that police busted an AI fake ID money laundering case, warning citizens never to upload ID cards and facial videos to unknown platforms.
• CCTV exposed the AI face-swapping black industry through channels like Sina News, with police emphasizing that dynamic facial videos are highly sensitive biometric information and strictly forbidden from being provided to any non-officially certified channels.
• The Taiwan FactCheck Center released a report indicating that online rumors regarding 'AID biometric data fraud' are often exaggerated, but biometric data does require protection, and the public should remain vigilant against data collection conducted under the name of 'AI protection.'
• Following the crackdown on massive LINE account fraud cases, the Taiwan Criminal Investigation Bureau publicly appealed that social accounts and identity verification data should be managed through official channels rather than delegating them to third-party 'digital identity agencies.'

How to Protect Yourself

• ✅ Never upload ID cards, photos holding ID cards, or dynamic facial recognition videos to any platform claiming to provide 'AI-generated digital identities' or 'virtual avatars replacing real documents.' Such services inherently involve assisting in identity forgery, and once submitted, data cannot be recovered.
• ✅ Maintain vigilance against anxiety-driven advertisements such as 'free identity security checks' or 'digital identity risk indices.' Verify whether platforms possess genuine corporate registration information, Cyberspace Administration or Public Security organ filing numbers, and cross-verify using the MIIT ICP filing query and Public Security networking filing systems.
• ✅ Regularly check recently logged-in devices and authorized applications across banks and social platforms. Upon discovering abnormal facial recognition verification or unfamiliar account registration records, immediately freeze the relevant accounts and appeal to the platform's security center.
• ✅ If biometric information has already been uploaded, report the case to local public security organs as soon as possible, retaining chat logs, transfer screenshots, and website domain evidence. Concurrently, contact the Credit Reference Center of the People's Bank of China to check whether your identity has been fraudulently used to apply for loans, and apply for a credit report anomaly flag if necessary.