QR code payment is ubiquitous in Chinese cities. Every vendor from ritzy salons to late-night barbecue skewer stalls will have a small square print that you scan with your smartphone to send payment.

Yet intrepid fingersmiths are often fumbling for ways to exploit the technology.

Last week, just as China’s central bank implemented new security regulations on payments using QR codes, police in eastern China’s Jiangsu province arrested three men on suspicion of theft. According to local newspaper Modern Express, greengrocers reported to police that the suspects had swapped the QR codes for receiving electronic payments to intercept the vendors’ income.

Police said that the trio, arrested Wednesday, are accused of stealing 3,000 yuan ($500) from vendors in Nanjing, Jiangsu’s capital.

All three men — surnamed Zhang, Zhao, and Zhu — are reportedly unemployed. Inspired by their mutual friend’s success from the same method, the trio in March decided to try their own luck, generating QR codes with two accounts registered on an unnamed third-party payment platform. One account was registered to Zhang, but the other account was not bound to a real name, making it more difficult for police to trace.

Although both of China’s biggest mobile payment platforms, Alipay and WeChat Wallet, have required users to register with government-issued identification since 2016, accounts without a real-name registration remain partially functional.

The three suspects were arrested the same week that national regulations on QR code payments took effect. The People’s Bank of China released a trial notice in December, effective from April 1, to enhance payment security and ensure fair competition between third-party payment platforms. The rules stipulated that an individual could only pay up to 500 yuan each day through static QR codes — which are widely used by small business owners but easy for thieves to replace.

Dong Ximiao, a researcher at Chongyang Institute for Financial Studies at Renmin University of China, wrote in a commentary that the regulation would help prevent and control risks by standardizing usage of the technology. Though QR code payments are a positive innovation, Dong wrote, the regulations clarify that the technology is best suited to small transactions for the sake of convenience.

Nonetheless, payment apps continue to grow in popularity. According to Tenpay, the third-party payment platform behind WeChat Wallet, 800 million users generate over 600 million transactions every day on the platform.

Editor: Qian Jinghua.

(Header image: A woman buying seafood looks at QR codes used to make mobile payments at a market in Beijing, June 27, 2017. Allison Jackson/VCG)