Alipay responds to real-name authentication vulnerabilities

Recently, a news report about Alipay's real-name authentication flaws has buzzed: One netizen claimed that he had five unknown accounts under his real-name authentication information. Alipay then responded that if any other related accounts were found under the Alipay real-name authentication account, it was because the account holder had personal information such as identity cards leaked, which led to the associated certification, and the sub-account could not be used to borrow money.

The user stated that he had accidentally opened the Alipay real name authentication page after logging in to Alipay, and only discovered five unknown accounts under his own real-name authentication information. What this user is worried about is whether under the same real name certification, these 5 unknown accounts will be loaned in their name and allowed to repay.

Alipay responded that the sub-accounts that were bound under the user's account could not be used to initiate loan services such as ant flower buds. Because of the opening of services such as ants and flower buds, not only will there be more reference to more comprehensive user information and historical consumer data of the user, but also additional wind control measures. "Alipay also provides user protection services for users. If the account is stolen, there will be a financial loss. The insurance company co-operated by Alipay will pay the user up to a maximum of 1 million, which fully protects the user's rights from the perspective of insurance."

However, there are still industry insiders expressing concern: “This vulnerability stems from the theft of personal information. Alipay has the potential to bind an account with incomplete user authentication. There is also some negligence on the part of the user, such as disclosure of personal information. Or account password or email leaked."

It is understood that Alipay real-name certification is divided into several categories: only the authentication of the account can use the transfer, repayment, payment services, and there is a limit to small payments. With the bank card verification users, there are still restrictions on small payments, but you can enjoy services such as wealth management, insurance, loans, and Taobao. With real-name authentication through identity verification, bank card verification, and document review, you are free to collect and pay and enjoy all the above services. Adding an account under a certification account requires not only the account name and payment password of the added account, but also the real-name verification of the payment password of the account and the authenticated ID number and other information. However, the page for adding an account shows that "You can add an unnamed account to your name. Once you add it, your identity information will be shared and cannot be removed."