The core issue here is: if the money has already been credited and a genuine KYC user logs in and requests assets from the platform, should the platform give the money or not, and to whom?

The scenario is particularly heartbreaking. Suppose you buy someone else's KYC identity information, and the other party withdraws a refund from the platform, then you log into a major exchange using this identity and find your assets have mysteriously disappeared. At this point, you ask the platform why the money was transferred away, how would they respond?

In simple terms, this involves a conflict of rights among three parties: the genuine KYC holder, the actual recipient of the funds, and the platform itself. Current account security policies and identity verification mechanisms often lack a clear framework for handling such complex scenarios. Platforms usually freeze assets citing "identity mismatch" or "illegal operation," but who is the true victim and who should bear responsibility remains a blurry line.