Stolen bank cards are being bought and sold online for several hundred yuan each in China, exposing huge risks for personal information security.

Some of the transactions take place via QQ instant messenger software and also on taobao.com, China's largest online marketplace, the Global Times has found.

"We prefer trading by Alipay, which can ensure safety for us," a vendor who claimed to come from Hangzhou, Zhejiang Province and who runs a Taobao shop, told the Global Times Sunday.

Taobao.com has officially banned sales of bank cards, but the vendor uses pictures and information for standard products like USB devices and cell phones in his online store description to evade inspection.

"In this way, no one would intervene in the business," the vendor said. But he refused to reveal how many cards he sells each month.

A search for "bank card sales" on Chinese search engine baidu.com showed over 6 million results Tuesday.

As taobao.com only inspects by checking the key words displayed in online stores' descriptions, it is almost impossible for the e-commerce platform operator to supervise what these shops are actually selling offline, Zhao Nige, a member of the public relations staff with taobao.com, told the Global Times on December 11.

"Scrutiny exists all the time, but if this illegal trading takes place offline, we cannot find them out and need the public to report them to us," Zhao said.

Stolen information

The bank card scalpers have two ways of getting the bank cards: buying them from people who don't use the cards and are willing to sell them, and applying for cards from banks after acquiring people's stolen ID information, media reports said.

The second method is the most common, the scalper from Zhejiang Province told the Global Times.

Six Shanghai residents suddenly found their bank savings had disappeared last year, after their bank account information was sold by a credit card center employee, according to a news report by China Securities Journal in 2011.

An employee surnamed Hu, who worked in a Shanghai-based credit card center, stole private information of many of the center's customers from the in-house system, and then sold it at a price of 10 yuan ($1.6) for each piece of information, it reported.

"I used QQ accounts to do the business, identifying myself as 'financial graduate' and 'banking scalper' to suggest I can have access to bank customers' information," Hu confessed after being arrested.

The report said Hu illegally traded the customers' information almost on a daily basis from November 2011. Sometimes he sold the data of 10 to 20 people a day.

In most cases when people's banking information is exposed, bank employees are involved in stealing it, Peng Bing, professor of law with Peking University, told the Global Times Monday.

But there is currently no law in China specifying what penalties a person can face for selling stolen bank cards or buying the information, he said.

Demand for cards

Some owners of small and medium-sized enterprises (SMEs) are major buyers of the questionable bank cards, as they use them for tax evasion purposes, People's Daily reported on December 5.

China has a progressive personal income tax scheme so that the higher the income, the more tax a person needs to pay. By distributing income among multiple bank accounts under different names, the SME owners can pay less tax by appearing to have lower income, according to the newspaper.

The prices of the bank cards range from 200 yuan to 550 yuan, according to several scalpers contacted by the Global Times. "Cards with e-banking services are two to three hundred yuan more expensive than those without," said a scalper from Hubei Province.

The man claimed that all the cards he sells can be used. He said most of his cards were applied for by using identification information stolen from other people, while some were applied for with counterfeit certificates.

"Bank cards applied for with authentic ID information can be used at least for half a year, and even when these bank cards' real owners find out about the existence of these cards and apply to cancel them, it usually takes half a year for them to finish the process," the man said.

Holes in the system

When a person opens a new bank account, the bank checks their ID card information and compares the ID picture with the person.

But in reality, if an impostor looks similar to the ID card photo, bank staffers sometimes do not pay too much attention, China Business News reported in May, citing a scalper surnamed Chen.

The information stored in bank cards, especially those that have magnetic strips, can be stolen when customers insert their cards into an automatic teller machine that has been tampered with by criminals, according to media reports.

As a result, China has been pushing to replace the vulnerable magnetic strip bank cards with more secure IC cards over the past two years, but the progress is slow due to the higher cost of the IC cards, China Business News reported in May.

Banks also need to invest a lot to replace their ATM terminals and promote the adoption of IC bank cards, the report said.

Though the Industrial and Commerical Bank of China (ICBC) has been issuing IC cards since June this year, most of its customers' bank cards are still magnetic cards, an ICBC hotline staffer told the Global Times Sunday.

In China, there is still no dedicated law for protection of personal information, said Zhang Long, a lawyer at Beijing Yingtian Law Firm.