AI face-swapping and voice-cloning scams are occurring frequently. In 2025, how can ordinary people use the Civil Code and the Anti-Telecom and Online Fraud Law to recover their losses?
When an "acquaintance" asks to borrow money, your eyes and ears may both be deceiving you.
"I saw his face with my own eyes and heard his voice with my own ears. How could it be fake?" This is the most common confusion among victims in recent AI face-swapping and voice-cloning fraud cases reported by police in multiple regions. According to a notice from the Cybersecurity Bureau of the Ministry of Public Security, since 2024, telecom and online fraud cases using AI deepfake technology have risen sharply year on year, with the average loss per case far exceeding that of traditional fraud. Scammers collect photos and voice clips of target individuals through social platforms, then use AI tools to synthesize realistic video call images and voices, impersonating relatives, friends, supervisors, or even public security, procuratorial, and judicial personnel to induce victims to transfer money. The "three-second silence method" proposed by police—that is, asking the other party during a video call to perform a specific action or say a preset code phrase—can indeed identify forgery to a certain extent, but this is only an emergency measure at the end. From a lawyer's perspective, what ordinary people truly need to master is the legal remedy path after a transfer: once the money is transferred, under what law can it be pursued? From whom? And how?
Legal characterization: AI fraud is not a "new type of crime," but rather a technological upgrade of traditional fraud.
From a criminal law perspective, AI face-swapping and voice-cloning fraud does not create a new crime. The perpetrator fabricates facts and conceals the truth, causing the victim to fall into a mistaken understanding and dispose of their property, which fully conforms to the constitutive elements of fraud under Article 266 of the Criminal Law. The real difficulty lies in evidence preservation and subject identification—the "face" you see is fake, and the "voice" you hear is synthesized, so who should be held responsible for this loss?
Three levels of legal liability need to be distinguished here. The first level concerns the criminals who directly carry out the fraud, who bear criminal liability for fraud. At the same time, under Article 148 of the Civil Code, where one party, by fraudulent means, causes the other party to perform a civil juristic act contrary to its true intent, the defrauded party has the right to request a people's court or arbitration institution to rescind it. This means that the victim may assert that the transfer is invalid and demand the return of the property. The second level concerns persons who provide AI face-swapping tools, technical support, or personal information data, who may constitute accomplices to fraud or the crime of aiding information network criminal activities. The third level concerns social platforms or payment platforms that fail to fulfill their review obligations. If they fail to implement real-name verification, risk monitoring, and early warning and dissuasion obligations as required by Articles 21 to 24 of the Anti-Telecom and Online Fraud Law, they may bear corresponding administrative liability and supplementary civil compensation liability.
The golden 48 hours after a transfer: payment suspension, evidence collection, and police reporting in parallel.
Many victims, upon discovering they have been scammed, first try to confront the scammer or repeatedly verify what happened, missing the optimal window for payment suspension. Under Article 31 of the Anti-Telecom and Online Fraud Law, the emergency payment suspension and rapid freezing system established by public security organs together with relevant departments is the most effective administrative means of recovering funds. In practice, reporting the fraud and initiating payment suspension within 30 minutes of being scammed yields the highest success rate for intercepting funds; after 48 hours, the funds have often been transferred through multiple layers of accounts or even flowed overseas, making recovery dramatically more difficult.
The sequence of actions recommended by lawyers is: Step one, immediately call 110 or go to the nearest police station to file a report, and at the same time call the bank's customer service hotline to apply for a temporary freeze on the account involved; Step two, completely preserve all evidence, including chat records, call screen recordings, transfer receipts, and the other party's account information. Take special care not to delete any data. Even if the AI face-swap video itself cannot be played, the original file must still be retained; Step three, cooperate with the police in retrieving IP logs, account registration information, and fund flow records. Here is a practical point that is easily overlooked: if the scammer uses overseas servers and cryptocurrency to receive payments, the probability of recovering the funds is extremely low. In this case, the focus of rights protection should shift from recovering stolen assets to civil claims—suing the "helping information network crimes" personnel who lent out bank cards and phone cards, as such people often have executable assets in China.
Feasible paths for civil claims: suing the cardholder and the platform is more realistic than waiting for criminal asset recovery.
When criminal asset recovery is difficult, civil litigation is an important supplementary channel for victims to recoup their losses. In accordance with the spirit of the judicial interpretations of the Supreme People's Court on the trial of cases related to telecom and online fraud, persons who, while knowing that others are committing fraud, still provide bank cards, payment accounts, or mobile phone cards shall, in addition to bearing criminal liability, also bear civil compensation liability for the victims' losses. In practice, there have already been many precedents supporting victims in directly suing the "card owners" for compensation, and in such cases the defendants' identities are clear and they have executable property, so the rate of actual enforcement after a favorable judgment is relatively high.
Another defendant worth noting is the social platform. If a platform fails to perform real-name verification for newly registered accounts as required by Article 21 of the Anti-Telecom and Online Fraud Law, or fails to issue risk warnings for abnormally frequent deepfake video calls, the victim may argue that the platform was at fault and demand that it bear corresponding supplementary compensation liability. In 2024, some courts have already ruled in similar cases that platforms bear 10% to 30% supplementary liability. Of course, the standards for determining platform liability have not yet been fully unified in judicial practice across different regions, and judgment must be made in light of the specific circumstances of the case and the platform's technical capabilities.
The Legal Significance of Preemptive Prevention: From the "Three-Second Silence Method" to Tiered Account Management
The police officer's "three-second silence method" essentially uses the time lag and motion continuity flaws in real-time AI synthesis to identify forgeries, but this is not foolproof—as technology iterates, the naturalness and response speed of real-time face swapping are rapidly improving. From the perspective of legal risk management, ordinary people should establish institutional preventive mechanisms: first, minimize the disclosure of personal biometric information and reduce the posting of clear frontal-face videos and long voice recordings on public social platforms; second, agree with family members on transfer code words or two-way confirmation rules, upgrading "single-point verification" to "multi-point verification"; third, use the account tiering, limits, and delayed transfer functions provided by banks to set a "cooling-off period" for large transfers.
For enterprises, the risk of AI fraud is even more severe. There have been multiple cases where finance staff were induced to transfer funds by forged "boss" video instructions. Enterprises should, in accordance with the Accounting Law and internal financial policies, establish mandatory procedures such as dual review, call-back confirmation, and delayed settlement for large payments, and must not release funds based solely on video or voice instructions. Once a loss occurs, enterprises can also review whether there were faults in their own internal controls to determine the boundaries of accountability toward the relevant personnel.
AI technology has lowered the threshold for fraud, but the legal standards for protecting property rights have not been lowered. From the right to rescind contracts due to fraud under the Civil Code, to the emergency payment suspension system under the Anti-Telecom and Online Fraud Law, and to civil recovery claims against those who assist information network crimes, victims have no shortage of legal tools available. The key lies in the speed of action and the completeness of evidence. Guangdong Zhiming Law Firm has long handled cases involving rights protection for victims of telecom and online fraud, and has accumulated extensive practical experience in assisting with emergency payment suspension, filing civil claims against cardholders, and pursuing platform liability. If you encounter a similar situation, it is advisable to seek the intervention of a professional lawyer as soon as possible to avoid irrecoverable losses caused by procedural errors.
