Explore each chapter to understand the effort, benefits and context.
The stakes here are your money and your identity. Someone who gets into your accounts may take your funds, impersonate you, or scam people in your contacts. This chapter covers practical account security and, where indicated, rights under Chinese law.
Two-step verification asks for something beyond your password to confirm that it is really you signing in. In the study cited below, a prompt on a trusted phone blocked more than nine out of ten phishing-based takeover attempts. Older checks, such as asking where you last signed in or what your recovery email is, blocked as few as one in ten.
An attacker can take a password leaked by another website and try it on your email. Once inside, they can reset passwords for other accounts linked to that address. Your email password should therefore be unique.
Your SIM is the small card that receives text-message verification codes. If you lose your phone, someone may move the SIM to another handset, receive those codes and reset your accounts. A SIM PIN requires a code when the card starts up in another phone, cutting off that route.
The order matters. First suspend the SIM so no one can receive your verification codes. Then lock the phone remotely, use a computer to change your email and payment passwords, report the loss or theft to the police and obtain a record, and freeze bank cards if necessary. You can call your carrier from someone else’s phone.
Under the Chinese rules discussed here, a bank claiming that you made or authorized a disputed payment must provide evidence for that claim. You should also gather evidence supporting your report of fraud. Act immediately: if you delay reporting the card and losses continue, you may have to bear the additional loss yourself.
The device list shows phones and computers that can still access your account. An intruder may remain quiet before doing anything obvious. If you spot an unfamiliar device or an old app that still has access, sign out all sessions and change the password.
Under China’s Personal Information Protection Law, an app generally cannot refuse a service merely because you decline data collection that is unnecessary for that service. Collection must be limited to what the purpose requires. Location can be relevant to navigation; your contact list is not necessary for a flashlight.
Chinese law gives you rights to access and copy your personal information, correct it and, in specified circumstances, have it deleted. A business should proactively delete information when the service ends, the retention period expires or you withdraw consent, subject to the applicable rules. If it refuses a rights request, it must explain why; you may bring a court action. Closing an account and deleting its data are separate steps.
China’s facial-recognition rules say that where another method can meet the same purpose or equivalent service requirements, facial recognition cannot be the only option. If you decline it, a reasonable, convenient alternative should be offered, such as a card, password or identity document. A provider must not pressure you by saying that the service is otherwise unavailable. Facial-recognition equipment is prohibited inside private spaces such as hotel guest rooms, public bathing areas, changing rooms and toilets.