The 3-Second Scam

At three in the afternoon, Lin Yue scrolled past a post on Xiaohongshu. It promised a "collaboration opportunity" with a new café. The photo showed a round table covered in a linen cloth, with three desserts on it: crème brûlée with a charred top from a blowtorch, and a latte with a tulip pattern in the foam. The caption said the shop was looking for the first fifty "ordinary experience ambassadors" to try the menu for free, with only a 648‑yuan deposit required—fully refundable upon arrival.

She sent a direct message. The reply came instantly: a QR code and a message: "Scan to reserve your spot."

When the payment page loaded, she glanced at the merchant name: "Shanghai miHoYo Yingtie Technology Co., Ltd." She paused for a second, but the other person urged her: "Only two slots left—pay now before they're gone." She pressed her fingerprint to confirm.

The money was gone.

Her contact blocked her. The post had disappeared. And on her transaction record, the 648 yuan was clearly marked as a miHoYo top‑up.

She wasn't the first.

I. The Anatomy of the Scam

Before reconstructing the chain, let's answer a few questions.

What are the indispensable links in this chain? Lead generation, persuasion, QR‑code payment, conversion of funds into virtual currency, and laundering that currency. Five links, each depending on the next.

What is the underlying logic of the relationship between the scammer and the victim? It is not simply "bad guy versus good guy." The scammer needs someone who does not play games, has no instinctive reaction to the number 648, trusts the social sharing atmosphere of the platform, and has formed a muscle memory for QR‑code payments. Lin Yue matched every one of those criteria. This was not an accidental stumble—she was deliberately targeted.

What is the emotional arc? It moves from expectation (a free experience) to trust (the other party is warm and responsive) to confusion (the payment page shows a game company) to anxiety (the other party pressures her) to compromise (she presses the fingerprint) and finally to confirmation of fraud and self‑doubt: "How could I be so stupid?" The temperature rises from a 5 to a 70 during expectation and trust, then plunges to zero at the moment of payment, then slowly climbs back to a humiliated 30.

Which scenes are essential and cannot be cut? The moment of pressure before payment; the three seconds of hesitation when she sees "miHoYo" on the payment page; and the blank chat screen after being blocked. If any of these three is missing, the reader cannot feel either the mechanical precision of the fraud or the layered texture of the victim's psychological shift.

II. The Law Cannot Run as Fast as the Money

From a legal standpoint, the crime is not complicated. Article 266 of China's Criminal Code states that anyone who defrauds another of property in a relatively large amount shall be sentenced to up to three years in prison. With multiple victims, the cumulative amount easily crosses the "relatively large" threshold.

But "can be prosecuted" and "can get the money back" are separated by an entire industry.

The money enters miHoYo's system. The 648 yuan goes through an official payment channel (Apple or Android). The game company receives the funds and issues the equivalent amount of virtual currency to a designated account. The game company is not a fraudster—it is fulfilling its contractual obligation. Real money becomes, say, 6,480 Primogems or equivalent. The scammer then sells these virtual currencies on third‑party trading platforms at a discount—say, 20% off—netting 518 yuan in cash.

That 518 yuan has no legally traceable connection to Lin Yue's payment record.

When the police trace the transaction to miHoYo, what they get is: "Account X received a top‑up from payment order Y at time Z." But if Account X has already traded those Primogems to Account A, and Account A has split them into a dozen sub‑accounts, the trail goes cold. The way virtual currencies flow within a game ecosystem is inherently multi‑layered, dispersed, and cross‑server. This is not the game company helping criminals; it is a structural property of that economic system.

The difficulty in recovering small‑scale fraud has never been about legal definition. It is about operational cost. A single 648‑yuan loss does not justify the man‑hours of a full investigation. The scammer banks precisely on this calculus: the loss hurts, but not enough to make you fight to the end.

III. What the Platform Can See

Go back to the moment Lin Yue scrolled past that post.

Xiaohongshu's content moderation system processes millions of notes every day. "Collaboration opportunity" and "fan perk" are common, legitimate phrases. "Scan to pay" triggers a flag, but if the QR code is embedded in an image rather than written as text, detection becomes harder. As for "648"—in anti‑fraud contexts, it is a textbook alert signal—but in gaming circles, it is the most ordinary top‑up amount. The moderation system's dilemma has never been "can we block it?" but "what happens if we block wrongly?"

But here is the catch: when the same templated pitch, from the same batch of accounts, following the same payment‑guidance pattern, appears on the platform in bulk, the pattern becomes identifiable. Pattern detection does not need to examine each individual piece of content—it looks at clustering of behaviours. If the cluster is clear and the content continues to be distributed, then the question shifts from "technology cannot catch it" to "the technology is not set to catch it."

Article 38 of China's E‑Commerce Law is explicit: if a platform knows, or should have known, that an operator is infringing consumer rights and fails to take necessary measures, it bears joint liability. "Knows" is easy—there is evidence. "Should have known"—given that anti‑fraud authorities have repeatedly issued warnings about this modus operandi—whether the platform's algorithms have shown sufficient alertness to the combination of "exploration + QR + 648" is an unavoidable question.

IV. Risk Control Is a Choice

miHoYo's legal team will say: we are a bona fide third party. A user voluntarily tops up, we deliver the corresponding virtual goods, and the transaction is legally sound.

That is factually correct.

But when the same game account receives dozens of 648‑yuan top‑ups within hours, from different payment accounts, different devices, and different geographic locations—what colour does that "pattern" show up as in the risk‑control system's data model?

Banks would flag such an account, freeze the transactions, and call to confirm. Game companies operate under a different risk logic. Their risk models primarily target "minors," "stolen cards," and "unauthorised third‑party top‑ups." Those directly touch regulatory red lines. "Multiple accounts charging the same account" sits far lower in priority than "a minor making a large single payment" or "chargeback fraud." It is not that the system cannot recognise it; it is that the threshold has been set too high.

Setting it high is a business choice. False positives—blocking legitimate players—generate customer complaints, channel disputes, and social‑media outcry. In commercial terms, those costs outweigh letting a few suspicious transactions slide. This is not technical incompetence; it is a calculated trade‑off.

But when a scam pattern has reached a scale that causes social harm, can "business choice" remain an excuse that only accounts for the company's own ledger?

V. What Lin Yue Did Next

She screenshotted all chat logs, payment receipts, and the scammer's profile page. By then, the profile had become "User has been deactivated."

She went to the local police station and filed a report. The officer told her that the amount did not meet the threshold for a single case. They would log it and wait for other victims to come forward for a combined investigation. She received a case‑acceptance receipt with an official stamp, but no promise of what would happen next.

She called miHoYo's customer service. The agent said: "We understand your situation, but the top‑up has already been credited, and the virtual items have been issued. We cannot reverse the transaction. We suggest you file a police report, and we will cooperate with law enforcement upon request."

She submitted a complaint to Xiaohongshu. An automated reply: "We have received your feedback. We will process it within 1–3 working days."

Three days later, she received a system message: "After verification, this account has violated our rules and has been permanently banned."

That was it.

VI. One Small Action

The most telling detail in this story is not the scammer's method, nor the platform's negligence, nor the game company's commercial calculation.

It is the three seconds that Lin Yue paused when she saw "miHoYo" on the payment page.

Her inner monologue at that moment: Why does that name sound familiar? Have I seen it somewhere? But the other party was urging her, and she did not want to seem clueless, did not want to lose her "slot" because of hesitation.

She did not take a screenshot of that page. Later, she could not even reconstruct what exactly she had hesitated about.

If someone had been beside her and simply said "wait a moment," that 648 yuan would not have been lost. But no one was there.

Later, she posted her story on Xiaohongshu. Under her post, dozens of comments flooded in: "I was scammed too." "Also 648." "Also miHoYo."

She collected those replies, organised a timeline, and sent it to the police station's investigation mailbox. No reply came.

She did not know whether the accumulated amount from all those victims would be enough to move the case forward.

All she knew was that the dessert photo from that afternoon was fake. The caramelised top had been retouched, and the tulip latte art was stolen from another blogger's gallery.

She learned one thing after that: before scanning any QR code, look at the payee.

If the payee is not the shop, the person, or the institution you are actually paying, stop.

Three seconds is all it takes.