"The password-free payment that I opened, the amount of more than two hundred, you need to enter the password, now just use the payment code of Jingdong to swipe thousands of dollars, such a large amount, even the password does not need to enter, the security of Jingdong payment is too low That's it!" Mr. Hu, who lives in Haizhu District, Guangzhou City, asked someone to rob Moutai on JD.com a few days ago, but unexpectedly, instead of looting Moutai, he was stolen for nearly 3,000 yuan.
On the 24th, Mr. Hu told reporters that he authorized an agent to log in to snap purchases with his account, but the other party could easily swipe away several thousand yuan only through the payment code of Jingdong without knowing the payment password. This makes Mr. Hu doubt the security capabilities of JD.com. On the 25th, JD’s customer service staff stated that JD’s payment code is similar to WeChat’s payment code. As long as it cooperates with JD.com, merchants can activate the payment collection function. “There should be no limit for a single transaction. It can be deducted at one time without entering the payment password". Mr.
Hu said that because the deducted funds were a virtual merchant, “JD’s customer service said that it could not find the corresponding merchant and there is no way to trace it back. I suggest that I call the police”. In fact, the vigilant Mr. Hu called the police on the night of the incident, and the police accepted the case.
hired someone to rob Moutai and was stolen for nearly 3,000 yuan.
Mr. Hu is a regular customer of JD.com and has spent more than 100,000 yuan on JD.com. Before and after "Double 11" this year, JD APP launched a rush to buy Moutai. “It costs 2600 yuan to buy in a physical store, but JD.com is only 1,500 yuan, and the supply may be more reliable.” Considering that there are more gatherings of relatives and friends on weekdays, Mr. Hu wanted to buy more bottles of Moutai.
However, Moutai is not easy to buy, so he added a QQ group to grab Moutai. Soon, someone took the initiative to come to the door. Mr. Hu agreed with the other party to "pay a 360 yuan commission for grabbing a bottle of Moutai", "He said to grab a bottle of Moutai for me, and then I will pay." Mr. Hu told reporters that this is the first time he has let someone log in on Jingdong. Grab merchandise with your own account. Earlier, he had asked people to help snap up things on other shopping platforms. "Others log in to my account, and after they grab it for me, I will log in to pay." Therefore, he expects Jingdong to do the same. He provided his mobile phone number according to the request of the other party. After obtaining the mobile phone verification code from Mr. Hu, at 8:47 pm on November 20th, the pair successfully logged in to Mr. Hu’s JD account.
Only three minutes later, Mr. Hu received a message stating that he had paid 1,000 yuan by bank card. Immediately afterwards, JD Finance also sent a message, "Said I paid 1999 yuan using a white bar." Mr. Hu's JD account was stolen and brushed nearly 3,000 yuan.
noticed that Mr. Hu immediately logged in to his JD account and kicked the other party's login device. "I have a quota of more than 20,000 yuan. Fortunately, I found it early, but it was unimaginable." After
discovered that it was stolen, Mr. Hu immediately went to the local police station to report to the police, and the police accepted the case.
Jingdong payment code high payment does not require a password
"I didn't give him the payment password, how could my money be swiped away?" Mr. Hu was puzzled. After checking the payment information carefully, Mr. Hu discovered the clue. Payment SMS shows: The other party paid by scanning the QR code. Mr. Hu discovered that Jingdong has a "payment code" function, "This payment code is similar to WeChat payment code, as long as you show Jingdong's payment code, you can sweep my money away."
transaction information shows that the other party Pay for stolen funds by scanning the QR code.
"Why does a shopping platform have the function of an electronic wallet? This is a very big loophole." Mr. Hu said that he did not know that JD had a payment code before, otherwise he would not give his account to a stranger. He also believes that Jingdong Payment "is unreasonable in its design that no password is required to pay such a large amount." After checking the transaction details, Mr. Hu found that the stolen 2,999 yuan was transferred to a merchant named "Shenzhen Photography Studio", "but this is a virtual merchant, and I can't catch it."
November 21, Mr. Hu reported the situation to JD’s customer service, “The customer service said that the merchant could not be found, and there is no way to trace who the payee is. I suggest that I call the police.”
JD’s customer service: There is no limit for a single transaction, and there is no need to enter the password
APP found,There is a "Sweep" icon in the upper right corner of "Home". After clicking the icon, the "Payment Code" function will appear. After passing the real-name authentication, binding bank card, face recognition, setting the payment password and other steps, the payment code can be successfully opened. At present, the payment code can support bank card, quick payment, white bar payment and small vault payment. But the reporter noticed that when entering the payment code page, the user does not need to enter the payment password or perform fingerprint verification.
Jingdong payment code.
To further understand the situation, the reporter called Jingdong customer service as a user on the 25th. The customer service staff told reporters that JD’s payment code is the same as the WeChat payment code. As long as they cooperate with JD.com, merchants can activate the payment collection function. Is there a limit for
Jingdong payment code? The customer service staff said: "There should be no limit for a single transaction."
"Unless you use a bank card to pay, the single limit function of the bank card will restrict consumption, otherwise there is no limit. For example, you have a white bar of 5000 yuan The amount can be deducted once using the payment code function, and there is no need to enter a password.” The customer service staff explained to the reporter. In addition, he also emphasized that as long as the user has enough credit, the money can be deducted at one time, "and there is no need to enter the payment password, and no fingerprint verification is required to enter the payment code page."
[Reporter] Chen Haiyan
[Intern ] Liu Yuhua
[Coordination] Cao Aimei
[Author] Chen Haiyan
Southern Probe
