A woman surnamed Zhao in Beijing did what many people do when they see a payment verification message on their phone: she ignored it.

But on January 12, she received a call from Baidu Wallet, the online payment platform operated Baidu. A company spokesperson told Zhao that her account tied to Baidu Wallet made two payments of 199 yuan and 500 yuan. The company asked if she made the transactions.

Baidu Wallet had blocked the second payment and warned that her account could have been stolen.

Zhao froze her account and called the police immediately. She said she never used Baidu Wallet and she did not bind any card to the platform. She could not trace where the purchase was made or what it was for.

Even without supplying the verification code, the person who stole her account was able to complete a purchase.

Baidu said the second payment was made less than a minute after the first, so the system recognized it as abnormal.

Baidu said her card was bound to the platform in November 2015, but it did not have an answer for why the transaction was completed without the verification code.

A banking expert who would not be named said verification codes sent by message can end up being emailed to a hacker if the user clicks an unknown link. Those using online payment solutions are advised to complete real-name verification on their platform of choice and protect their personal information.