China’s anti-fraud AI app declares user tracking, but its policy leaves the purpose unclear

In 2021, a Shanghai resident said police contacted him after he visited a US financial news service, asking about his overseas contacts and browsing habits. RFI cited the Financial Times interview in a report on September 14 that year. RFI’s October 22, 2026 article revisited the same account.

That reporting concerned the National Anti-Fraud Center app. A separate app, previously called 803 Anti-Fraud, was renamed National Anti-Fraud AI on August 24 this year. Shanghai police describe the service as a tool for checking suspicious calls or text messages. Users can describe what happened and ask questions by voice or text; the app explains scam techniques and offers examples of similar cases.

A SharpPost review of the app’s China App Store listing and linked privacy policy found that its developer, the Shanghai Research Institute of Criminal Science and Technology, lists usage data under “Data Used to Track You.” The disclosure says this data may be used to track users across other companies’ apps and websites. Apple notes that it has not verified the developer’s disclosures.

Under Apple’s definition, tracking includes linking user or device data with third-party data for targeted advertising or ad measurement, or sharing it with a data broker. Apple makes an exception when a broker acts solely on the developer’s behalf and uses the data only for fraud detection, fraud prevention or security. The app’s linked policy does not explain what the declared tracking is for or who receives the data.

For analytics, the developer lists product interaction data as linked to users’ identities, and device IDs and advertising data as unlinked. It also lists crash and performance data as supporting the app’s operation.

The privacy policy, hosted on a Shanghai police domain and dated August 20, 2026, lists names and phone numbers supplied by users; content viewed and search terms entered within the app; device models, operating system versions and IP addresses; and correspondence with customer support.

The stated purposes include maintaining the service, user research, notifications and fraud prevention. The policy also says the app uses Umeng’s SDK, a software component supplied by a third party, for analytics and basic anti-cheating functions. It lists MAC addresses, IMEI, IMSI and other identifiers, and says location data is used to improve the accuracy of statistical reports. IMEI identifies a mobile device; IMSI identifies a mobile subscriber.

The device-information clause closely resembles sample wording Umeng published in September 2020. In a September 16, 2025 update notice, Umeng said its latest analytics SDK no longer collected IMEI, IMSI or ICCID, and told developers to update their policies to reflect the features and settings in use. It warned that older versions could still collect identifiers dropped from newer releases. National Anti-Fraud AI’s policy does not specify its SDK version or configuration.

A September 9 report in Shanghai’s Jiefang Daily described a user repeatedly asking 803 Anti-Fraud for help on the evening of August 24. The user said they had downloaded screen-sharing software for a gaming prize draw and were following instructions from a stranger claiming to be a customer service representative. According to the newspaper, the system flagged the case as high risk based on the repeated late-night questions, urgency and potential financial loss. Shanghai’s 96110 anti-fraud service then called to intervene. The report did not explain how police obtained the phone number or how the chat was referred for staff to handle.

In an October 16 announcement about a campus anti-fraud event, Shanghai police said National Anti-Fraud AI and the Jinhu app had handled more than 4 million service interactions between them. They gave no separate total for either app.

People seeking help with a suspected scam may share details of their transactions, finances and family circumstances. The app describes consultation, analytics and tracking in separate disclosures, without explaining which data each involves. Users cannot readily tell which organizations may use the information they submit, what they may do with it or how long that use may continue.