The holiday is winding down, and the camera roll has filled up: scenery, reunion dinners, kids grinning at the table. A lot of people will dump all of it into WeChat Moments before the day is out.
Hold off on that send button. In February 2025, the cybersecurity bureau of China’s Ministry of Public Security posted a reminder on its WeChat account: seven kinds of photos are better left off social media. During this year’s National Day holiday, a number of outlets passed the list around again, since holiday photo dumps are exactly when it matters.
Another story made the rounds this week, and it is about the same thing—keeping personal information under control. According to CCTV News and other outlets, a woman surnamed Tan in Gong’an county, Hubei, was using the public Wi-Fi at a breakfast shop when she tapped a pop-up “check-in red packet” ad. Three charges totalling more than 850 yuan then hit her bank card, billed by an insurance company, with no verification code requested at any point. Police mediation got the full amount refunded to her account. The reports also warned that public Wi-Fi can hide traps.
Posting photos and joining Wi-Fi look like two small things. Underneath, both come down to one question: how to keep the personal data and the money on your phone safe. Here is the list, item by item, and two settings you can change today.
1. Seven kinds of photos to check before posting
Why is a photo risky? A single image may reveal little, but keys, tickets, ID documents and location data put together can establish where someone really lives, where they go and who they know. That is the point these reminders keep returning to.
Run through the seven:
- Your front door key. It guards your home. There is no reason for its shape to appear in a photo.
- License plates, train and plane tickets, boarding passes. These often carry a name and ID number. If you want the souvenir, blur the key details first, or skip the post.
- ID cards, passports, driving licences. This is core identity information. If it leaks, the damage from impersonation is the worst of any item here. Not one photo.
- Bank cards. The card number sits on the face. A full card in frame is your account number in public.
- Photos with location data. Many phones record GPS when shooting. Choose “don’t show location” when posting, and if you are unsure about an image, take a screenshot and post that instead of the original.
- Unboxing photos and videos. Delivery labels carry a name, phone number and address, and an unboxing video captures all of it. Tear off or cover the label first.
- Photos and names of elderly relatives and children. The official wording: to stop criminals from using their information for illegal activity. If you want to share a grandchild’s photo, use a limited audience and send it to family only.
There is a mnemonic for it: keys, tickets, documents, cards, location, unboxing, kids.
2. What the Wi-Fi charge actually teaches
Back to Tan’s case. According to the reports, the direct cause was the pop-up ad she tapped: it had a paid item pre-selected and was tied to password-free payment, which is why no verification code appeared. No official finding says the Wi-Fi itself was at fault.
The lesson still stands. With password-free payment switched on, one misplaced tap can take money out. Managing how you pay matters more than panicking about Wi-Fi.
3. Two things to do today
First: turn off password-free payment you don’t need.
WeChat: Me → Services → Wallet → Payment settings → Password-free payment / auto-renewal, then close each item you don’t use. Alipay: Me → Settings → Payment settings → Password-free payment / auto-deduction, same check. Menu names shift between versions; if you can’t find it, search for “password-free payment.” Once it’s off, memberships that used to renew themselves need manual renewal—a bit more trouble, one more lock on your wallet.
Second: review your Moments permissions.
For the three-day limit: WeChat → Me → Settings → Friends permissions → Moments → who can see your Moments, and choose “last three days.” Turn off “allow strangers to see ten Moments,” and check whether “People Nearby” is on. For photos of elderly relatives and children, restrict them to family. One more that matters: don’t use public Wi-Fi for payments, transfers or online banking; mobile data is safer. If you need a shop’s hotspot, ask the staff what their network is called before joining. The National Anti-Fraud Center makes the same point repeatedly in its 2025 handbook on preventing telecom and online fraud.
4. Three common misreadings
“Any public Wi-Fi will drain your bank account.” Not really. In this case the direct cause was a pop-up ad plus password-free payment, and the reports never claimed the Wi-Fi carried a virus. Chatting or watching videos on Wi-Fi is no reason to panic. What to avoid: unknown hotspots, red-packet pop-up ads, and any payment method that asks for no verification code.
“Delete the photo and the problem is gone.” The moment it is posted, it can be screenshotted and saved. Deleting does not take it back. The work belongs before you hit send.
“My Moments are all people I know.” Contact lists are full of people you haven’t spoken to in years. Restricted audiences and the three-day limit are not aimed at friends. They are aimed at accidents.
5. If a charge looks wrong, work through it in order
See an unfamiliar deduction on your statement? Three steps:
- Note the payee name and the time, and screenshot it as evidence;
- Look up the order in the payment platform’s customer service channel, cancel it if you can, and revoke any authorization attached to it;
- If it can’t be explained or settled, call the police. Don’t talk yourself out of it.
Tan’s 850-plus yuan came back in full after police mediation. Catching it early and acting quickly does work, which is why this piece exists: not to frighten anyone, but so you know what to do.
Final note
As the holiday ends, post the photos and take the rest. Just look once more before sending: run the seven-item check, switch off password-free payment, pay over mobile data.
Do you check a photo’s details before posting? Which of the seven had you never thought about? Tell us in the comments, and forward this to your family—especially the ones who love posting pictures of the grandchildren.
This article is privacy and security guidance. The individual case is retold from public reports including CCTV News; app menu paths follow the current interface.