Anthropic has thrown nearly every access control in the book at China: phone verification, foreign credit card checks, billing address scrutiny, bans on companies with more than 50 percent Chinese ownership, and even live-selfie ID verification for select users. None of it has stopped a thriving gray market from selling Claude API access at roughly a tenth of the official price.
The mechanism is something Chinese developers call “transfer stations” — API proxies hosted on servers outside China that accept requests, forward them as if they originated from a legitimate location, and relay responses back. Users pay in yuan through WeChat or Alipay. No VPN, no foreign card. Zilan Qian, a researcher at the Oxford China Policy Lab, mapped the ecosystem in an analysis published by ChinaTalk, describing it as a modular supply chain with account brokers, SMS verification platforms, and reverse-engineering specialists upstream, and resellers hawking access on Taobao downstream. Because most participants only operate one link in the chain, taking down a single provider barely registers. A replacement spins up within hours.
The economics are brutal for Anthropic. Operators farm the company’s free $5 credits, exploit education and enterprise discounts, and split $200 Max plans across multiple users through token quotas. Model swapping compounds the fraud: a proxy can quietly reroute a request meant for Opus to a cheaper Sonnet model — or even to Chinese models like Qwen. CISPA researchers found one endpoint labeled “Gemini-2.5” scored just 37 percent on a medical benchmark versus the official 83.82 percent. The community has a word for this: “diluting.”
Qian argues the customer base extends far beyond AI labs distilling Western models — students, hobbyists, app makers, and tech employees all buy access. Even Anthropic’s KYC-style checks now face dedicated workarounds, including AI-generated fake IDs and deepfakes for biometric verification. Where that fails, real people in low-income countries get recruited to pose for selfies. Qian points to the Worldcoin black market as precedent, where iris scans from Cambodia and Kenya traded for under $30. The implication is uncomfortable: the same modular infrastructure that defeats geoblocking also defeats abuse monitoring, and it’s now mature enough to operate like a legitimate commercial ecosystem.
