The Compliance Line for SMS Verification Services: Why It Is Criminal Risk, Not Just a TOS Breach

This is not a grey area — it is criminal risk

Let me be direct, because the framing matters: SMS verification platforms ("接码" in Chinese) are no longer a service-terms question in mainland China. They are a law-enforcement question.

In English-language commercial discussion, using temporary numbers is usually described as a terms breach with account closure as the worst case. In mainland China, bulk provision and sale of SMS verification codes engages the criminal code:

• Article 253-1 · Infringement of citizens' personal information: selling or providing citizens' personal information in violation of state provisions, in serious circumstances, carries up to three years' imprisonment, or up to seven years in especially serious cases, plus fines.
• Article 287-2 · Aiding information network criminal activity: knowingly providing technical support, server hosting, network storage, communications transmission, or advertising and payment settlement assistance to information-network crime, in serious circumstances, carries up to three years' imprisonment plus fines.

Note "communications transmission" in the second article. Receiving and forwarding verification codes is precisely communications transmission, and once downstream use is known, it sits squarely inside "providing assistance."

Three real cases from 2026

Case one — Xinjiang police, October 2026. A woman downloaded a fake lending app and lost RMB 85,000. Following the trail, police dismantled an upstream verification service for an overseas fraud group in Changsha, arresting 12 people. The ring bought shell company registrations, set up a studio in an office building under a trading-company name, recruited students on a "Taobao customer service, RMB 120 a day" pretext, and had them register real-name SIMs under the guise of "settling wages." On site: 510 mobile phones and more than 17,000 SIM cards. Officers noted explicitly that renting out business licences can itself constitute aiding crime.

Case two — Chengdu, October 2026. From 2023 onward, a company bulk-purchased phone numbers and real-time SMS codes at a few cents to several yuan each, used fake accounts on airline and ticketing platforms to claim new-customer promotions, and benefited from RMB 700,000+ in fraudulent subsidies. Four primary suspects were placed under criminal compulsory measures. Investigators also observed that paying overseas black-market platforms by private QR-code transfers to evade financial regulation was precisely what allowed the money trail to be followed.

Case three — Hubei, September 2026. Police seized 27 devices — three verification computers, four phones, and 500 real-name virtual SIM cards. The operation provided verification codes to black-market registrants for account creation, feeding downstream telecom fraud. Over 25,000 verification records were traded for RMB 20,000-plus in profit. The suspect was placed under criminal compulsory measures.

The shared structure: the buyer of a verification platform is not an end user but an upstream procurement channel for organised crime. Once you are on that chain, your numbers and your money are both traceable.

One detail in the Chengdu case worth generalising

Police emphasised a technical determination: airline new-customer promotions are limited to self-registered, real-name use. Therefore purchasing or impersonating another person's number and verification code to claim a promotion constitutes infringement of personal information regardless of how little profit was made.

That logic generalises: where your conduct involves impersonating another person's identity information for gain, there is no "I barely profited" defence. Both RMB 20,000 (Hubei) and RMB 40,000+ (Yantai) met the criminal filing threshold.

Three recommendations for individuals

1. Never rent or sell your phone number, bank card, or any account — not even as "idle number rental" for a monthly fee. If it is used downstream for fraud or volume manipulation, you are an accomplice, and the real-name trail points back to you.
2. Reject and report any "high-paying part-time job registering accounts" offer. In the 2026 operations, students and stay-at-home parents were lured in at RMB 120 a day and all ended up under criminal compulsory measures. Anti-fraud law explicitly prohibits "ficturing agency relationships to open accounts" and "providing real-name verification assistance."
3. Your real-name identity is your liability anchor. Phone number, ID, and biometric data are core private information. Renting them out rents out your legal responsibility with them.

Three recommendations for companies

① Maintain an asset register with explicit ownership. Not verbal agreement — written, with an owner, renewal date and risk status per number.

② Buy only from vendors with verifiable standing. Test: can they produce a legitimate entity and credentials, can they explain where the ranges came from, will they cooperate with KYC? "Volume discounts," "instant activation," "global number pool" are themselves the warning signs — legitimate carriers do not sell on those terms.

③ Treat risk signals as part of vendor evaluation. If a partner's pitch is "we help you open more accounts," no fee is low enough to justify the exposure.

So what do you do when the need is real

Going overseas genuinely requires numbers. The compliant paths:

The third row deserves emphasis. If what you need is "cheaply test a registration flow," the legitimate method is your own test environment and your own number resources — not numbers of unknown provenance. A purchased number is itself the risk: you do not know what it was used for before you.

Where this site stands

996618 Kit does not sell, broker or refer account trading or verification services. Three concrete reasons, none of them moral:

1. A site that sells accounts materially helps downstream fraud, gets reported, and gets taken down by the host.
2. Payment channels freeze. Account trading carries extremely high dispute and chargeback rates, and frozen funds are usually unrecoverable.
3. If a site is deemed to be providing assistance to crime, the operator's personal legal exposure bears no relation to the site's revenue.

That is not puritanism — it is risk arithmetic.

FAQ

Is it illegal if I only use one verification code myself for my own account? Personal use differs legally from selling or providing codes to others; "providing" and the fee element are what turn an operation into selling. That said, the downstream users of such platforms are overwhelmingly organised crime — the consistent finding across the 2026 operations. The risk-to-reward ratio is indefensible.

Is it compliant for a company to issue a batch of numbers to staff for internal testing? Yes, provided the number source is traceable (owned or contracted directly with a licensed operator), use is restricted to your own platforms and device environments, and it is never used to impersonate activity on third-party platforms.

How do I tell whether a virtual-number vendor is legitimate? Three questions: can they produce a legitimate entity and credentials, is the range source explainable, will they cooperate with real-name KYC? If they deflect all three and talk only about price and volume, stay away.