Alipay

Is Alipay safe to use?

For paying in China, Alipay and WeChat Pay are the two main options, and as a piece of payment security it holds up well: strong login options, encryption described in detail and no reported breach of user accounts that we could find. The weaker side is privacy and regulation. Data collected in China stays there under Chinese law, Apple's label covers more categories than most payment apps, and in July 2023 China's central bank fined Alipay's payment company about 3.06 billion yuan (roughly $425 million), part of a 7.123 billion yuan penalty on Ant Group and its units.

We score Alipay 50/100, above WeChat (36), the other app visitors to China usually need, and a little below PayPal (55).

How visitors use Alipay

Alipay's own App Store description is direct about this. People with a Chinese ID and bank account can use it at home and abroad. Foreign visitors can link a credit card to pay merchants across China, but the app "is not designed or intended for use by foreign users in their home country or anywhere outside of China". In practice that means a visitor installs Alipay for a trip, verifies identity with a passport, links a Visa or Mastercard, and pays by scanning or showing QR codes.

That identity check is part of the deal. The privacy policy says Alipay collects and stores data to meet real-name, anti-money launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary and payment rules, and that it reports to authorities where laws and regulators require it.

What data does Alipay collect?

Apple's label lists identifiers as used to track you. Linked to your identity it lists health and fitness data, location, contact info, contacts, user content, search history, browsing history, identifiers, usage data and diagnostics. The listing also warns that the app may use your location even when it is not open. For a payment app that is broad: PayPal's label, for comparison, has no health or fitness data.

The Alipay Payment Privacy Policy, effective 23 October 2025 and available in English, adds three points worth knowing:

• Personal information collected and generated in China is stored in China. Transfers abroad happen only where a cross-border service needs them.
• Alipay may use de-identified data for research and "machine learning or model algorithm training" without separate notice or consent.
• Advertising partners receive only data that does not identify you, unless you agree otherwise.

Ant's international arm has a record on data sharing too. Korea's Personal Information Protection Commission found in January 2025 that Kakao Pay had sent data on about 40 million users to Alipay daily from June 2019 to May 2024 without consent, and that Alipay used it to build scores predicting whether Apple App Store customers would have enough money to pay. The regulator fined Kakao Pay about ₩5.97 billion and Apple about ₩2.4 billion, and ordered Alipay Singapore E-Commerce to destroy the scoring model. The order went to Alipay's Singapore company, not the Chinese app, so we treat it as context rather than part of the app's own record.

Fines and orders

The July 2023 penalties closed China's long investigation of Ant Group. China's financial regulators fined Ant Group and its units 7.123 billion yuan in total, citing corporate governance, financial consumer protection, payment and settlement business, involvement in banking and insurance business, and anti-money launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary duties, the Associated Press reported. The central bank's share named Alipay (China) Network Technology, the payment company behind the app, directly: it was warned, had about 831 million yuan of income confiscated and was fined about 2.23 billion yuan. The seven listed breaches include rules on payment accounts, anti-fraud checks, customer identification, protection of consumers' financial information and financial consumer rights, according to the central bank's published penalty table (decision 银罚决字〔2023〕26号). Because the decision names the app's operator and covers how it treated users' data, we count it in full. It is a large fine by any measure.

An older episode shows how consent has been handled. In January 2018 Alipay's annual spending summary came with a tiny, pre-ticked box agreeing to Sesame Credit's service terms. Sesame Credit publicly apologised. The Cyberspace Administration of China summoned Alipay and Sesame Credit on 6 January, and the industry ministry summoned Alipay on 11 January over unclear notices about data use and ordered it to fix them at once.

India blocked the app in 2020. On 2 September its IT ministry listed Alipay and AlipayHK among 118 apps it said were collecting and sharing users' data "in surreptitious manner" and sending it to servers outside India. A later order on 24 November added Alipay Cashier. The central bank fine, the Indian block and the 2018 orders together put the regulatory record at 37.

How to use Alipay more safely as a visitor

1. Link a credit card rather than a debit card, so you keep your card issuer's chargeback rights if something goes wrong.
2. Turn on Face ID or fingerprint login and set a payment password nobody else knows.
3. Set location access to "While Using the App" in your phone's settings; the app does not need background location to pay.
4. Pay only by scanning a merchant's printed code or showing your own code at the till. Do not pay codes sent to you in chats.
5. After the trip, unlink the card, download your data under Me, Settings, User Protection Center if you want a record, and cancel the account through the "xiaohu" service.

How we scored it

Security (63) is Alipay's strongest factor: detailed encryption, biometric login and no known breach. Privacy (35) is its weakest, because of a broad label, background location and data that stays in China. The regulatory record (37) reflects the 2023 central bank fine on Alipay's payment company, India's 2020 block over data handling and the 2018 orders over pre-ticked consent. For the maps app many visitors install alongside it, see Amap.