Blinking Isn't Proof Anymore: AI Video Beats Face Scans

On October 26, "AI-generated video can now fool facial recognition" trended on Chinese social media. Comment sections filled with people saying their scalp went numb. But what unsettles isn't the technology. It's the question nobody under that trending topic asked out loud: the last time I scanned my face, who was on the other side of the screen confirming — me, or a fifteen-second clip?

A case published this year by the Hangzhou Intermediate People's Court puts the answer on the table. Two people collected strangers' photos online, used AI to animate them into nodding, shaking and blinking videos, then tampered with the camera data. That was enough to clear a shopping platform's face verification and strip the personal information out of the accounts.

The Yuhua District Court in Changsha heard a blunter version. A university student bought "AI face-forgery video" know-how from an illegal site, produced moving footage of someone else's face, reset that person's payment password, and ran up more than 50,000 yuan in fraudulent charges in under four months. No server room out of a hacker film, no insider. One person in a dorm room.

The "just blink" checkpoint was always a patch

Liveness detection, plainly put, asks the camera to confirm that a living person is sitting in front of it. Early versions relied on blinking, opening your mouth, turning your head. Later came light variation, screen reflection, infrared depth. Then randomized actions — the system tells you to turn left, or read out a string of digits.

The whole design rests on an unstated premise: faking a face that moves is much harder than faking a still one.

That premise collapsed in 2026. Feed a current video model a single frontal photo and within tens of seconds you get a clip with micro-expressions, breathing, a slight sway of the head. Tell it to nod and it nods; tell it to blink and it blinks. The cost? An expert interviewed by Global Times put a number on it: a few dozen yuan and ten-odd seconds of audio is enough to "replicate" anyone.

The real hole isn't in the model. It's in distribution

Worth stating plainly: attacks like these rarely depend on beating the most advanced algorithm. They beat the thinnest link in the process.

The first link is where the data comes from. Nobody needs to hack a database to get your face. A clear frontal photo from a WeChat Moments post, a job board, a secondhand marketplace avatar, a copy of your ID tucked into a courier waybill — any one will do. In the Hangzhou case, the suspects' entire method was described as "collecting from the internet."

The second link is how far the camera data can be trusted. Tampering with camera data sounds sophisticated; in practice, plenty of clients treat whatever the camera hands them as trusted input, with no signature check in between. The lock is solid. The door frame is cardboard.

The third link is reuse. One template can be applied to dozens of people in a batch, and when an account gets banned you spin up another. The marginal cost is close to zero. The experts' phrasing — "almost no barrier to entry, templates replicate at scale, ban one and they reshell" — isn't describing technology. It's describing the unit economics of a business.

Upstream of that chain sits a far more profitable trade

Skimming 50,000 yuan is the scale of a criminal case. The real volume is at the other end.

On October 18, the actress Wu Yue spoke out: an account was using AI to counterfeit her face and voice to sell skincare. Screenshots she preserved show the product had logged 16,492 cumulative sales, with revenue roughly estimated above 1.3 million yuan. At the end of the forged video, a knock-off of Deng Yaping's likeness appeared to keep pitching.

Dozens of yuan to produce, a million-plus in sales. That asymmetry is why this content keeps coming back. A ban isn't a punishment; it's a cost of doing business.

Regulators moved in parallel. The National Radio and Television Administration launched a campaign against "AI distortion," focused on unauthorised reworkings of the four classic novels, historical material and model figures. Major online video platforms took down nearly 13,000 violating videos in September alone. When the cleanup counts in the tens of thousands, supply-side capacity is already in surplus.

What ordinary people can do is more concrete than it sounds

CCTV's advice is practical enough to copy down:

On a video call, ask the other person to perform a specific action — blink three times in a row, touch their nose, wave a hand in front of their face. Face swaps slip up most under occlusion and fast movement: expect lag, edges that shimmer, or an unnatural warp.

On an unknown call where the other side says nothing, don't speak first. Wait three seconds in silence; if it's still silent, hang up. Voice samples are the raw material for cloning, and every extra sentence you say is another clip in someone's dataset.

Don't hand over your ID number, employer, home address or job title unless it is genuinely required. Keep your face, photos, voice and fingerprints out of mini-programs of unknown provenance.

For platforms, the effective moves aren't fancier liveness checks. There are three. Sign data at the capture end, so that "camera data" has a traceable origin. Force a second factor on high-risk actions instead of treating a face scan as the only credential. And reserve a signature slot on generated content — which model made it, who published it, what the platform did once it identified the material.

One conclusion that isn't comfortable

Much of this discussion pins its hopes on detection tools. But detection is permanently behind: you need a suspicious video first, and only then can you test it. Face payment happens before you ever see the video.

So the real fix probably isn't on the algorithm side. It's on the institutional and product side: demote the face from sole credential to supporting evidence, pull large transfers and password resets back to multi-factor verification, make provenance labelling on generated content the default rather than an option.

Technology has already driven the price of "looks real" down to pocket change. What costs money next is redefining what counts as proof that it's me.