Court Judgment Sheds Light on How Overseas Infringers Evaded E-commerce Platforms’ Identity Control

It is a well-known fact that overseas IP infringers often resort to using Taiwanese companies’ “SMS verification code collecting” services, abbreviated as VCC services, to masquerade as local users and bypass the identity restrictions typically imposed by Taiwan-based e-commerce platforms primarily designed for local users. 

The Taiwan IP & Commercial Court (IPC Court) issued a second-instance judgment in June 2023, affirming that such VCC services constitute a criminal offense in certain circumstances. NAOS v. Lee, Fu-Min-Shang 7, Taiwan IPC Court (June 2023). 

The court’s findings, based on investigations conducted by IP police and prosecutors, revealed the modus operandi of this criminal activity, which was conducted through the following steps:

1. Establishment of a Taiwanese VCC Company: Taiwan currently lacks prohibitions or restrictions on VCC services. Moreover, Taiwanese companies are permitted to apply for a large number of mobile phone numbers, and the issuance process by telecommunication companies is lenient.

2. Overseas Transactions via a Conduit: The VCC company promotes its services through an overseas conduit (in this case, a mainland Chinese individual), typically on a platform (e.g., Taobao). After overseas customers pay a fee (in this case, RMB20 per verification code SMS), they receive from the conduit a mobile phone number pre-registered by the VCC company. This number is then used to create an account on a targeted Taiwan-based platform. Once the verification code SMS is received from the platform, the VCC company forwards the code to the customer through the conduit.

3. Recycling of Phone Numbers: The entire service is for one-time use. Shortly after forwarding the verification code, the VCC company closes and recycles the associated mobile phone number, allowing a single number to be used by multiple customers.

4. Identity Verification: VCC companies may request identity documents from overseas customers and retain correspondence records. In legal proceedings, such materials are used to argue that they have fulfilled reasonable know-your-customer (KYC) checks. The defendant in this case followed this pattern.

5. Appropriation of Personal Data: To fulfill the additional personal information requirements imposed by Taiwan-based platforms for creating accounts, especially seller accounts, (such as names, ID numbers, and even bank account details), overseas infringers acquire this information from illegal sources.

6. Infringing Sales: Subsequently, overseas infringers advertise and sell counterfeit goods via platform accounts registered under the names of Taiwanese individuals, who remain unaware of the scheme until being summoned by the police following a complaint from the IP right holder.

IP right holders may suspect that these entities—the VCC company, the Mainland infringer, and the unknown personal data provider—are interconnected or just fictitious alter egos of one of the three, or the three are all controlled by an underlying organization. However, proving such connections is challenging, since normally Taiwan’s law enforcement agencies could track down the VCC company only.

In this case, the platforms exploited by the Mainland infringers were the Taiwan branches of Yahoo! and Shopee, two of the largest online shopping platforms in Taiwan. The counterfeit/infringing products advertised/sold by the infringers on these platforms included NIKE shoes, Bioderma cosmetics, RIMOWA luggage, and more.

The defendant in this case is the head of an IT company. Since 2020, this individual has faced charges in dozens of similar cases due to the provision of VCC services to Mainland Chinese infringers. The court’s decisions remain consistent across these cases:

  • The defendant was found guilty of both “assisting in the illegal use of personal data” and the lesser offense of “assisting in the commission of forging documents.” Sentencing was based on the former, as both crimes stemmed from a single act. The asserted KYC check was considered somewhat of a sham since it lacked a critical step: asking the customers why they needed the VCC services and how they intended to use the platform account.
  • In the recent case heard by the IPC Court, for each instance of the illegal VCC service, the defendant received a two-month prison term, which could be converted to a fine of NT$60,000. Additionally, his gains at RMB20 from each illegal VCC service were confiscated. As there were eight illegal VCC services uncovered in this case, the penalties were multiplied by eight.
  • However, the charges related to assisting in trademark and copyright infringements were dismissed due to a lack of evidence regarding the defendant’s intent, a prerequisite for such offenses.

While Taiwan’s criminal law recognizes the concept of “indirect intention,” this principle requires foreseeability and willful intent. In this case, the prosecutors argued that, since the defendant took no meaningful measures to control their customers, all of the customers’ illegal actions on the platforms in question should be deemed foreseeable to the defendant. However, the court did not accept this argument.

The court held that the defendant’s Mainland Chinese customers might have only intended to use the platform for shopping, leaving their subsequent actions, such as posting infringing product photos and selling counterfeits, as fortuitous and uncertain. Thus, the court found no evidence to suggest that the defendant had the necessary foreseeability and willful intent, nor that they engaged in or provided assistance in the infringement.

Nonetheless, assisting in trademark or copyright infringement is a lesser offense than aiding in the illegal use of personal data. Therefore, even if the defendant were convicted on both counts, the ultimate punishment would still be based on the crime of illegally using personal data, since both crimes originated from a single act. The real difference lies in the civil proceedings. If the defendant constituted an aider in the trademark or copyright infringement, he would be held jointly and severally liable for damages claims. 

Without a doubt, VCC services can be employed to evade any SMS-based identity verification, making them a versatile tool for various types of online crimes, with IP infringement being just one example. Prior to the regulatory enhancements in telecommunication laws concerning VCC services and, more importantly, the control over the application for cell phone numbers, the courts and prosecutors are entrusted with a more significant gatekeeper role. From this perspective, the recent judgment by the IPC Court is quite commendable, although it remains unclear whether it has been appealed to the Supreme Court.

Another crucial gatekeeper is the online platforms themselves. If they were to require users to undergo identity verification once again when upgrading to seller status or posting their first product advertisement, and if the verification code SMS sent for this purpose explicitly conveyed its intended use, the process of establishing the illegal intent of VCC service suppliers might become more straightforward.