miHoYo Appeared on a 648 Yuan School-Fee Scam Receipt. That Does Not Make It the Scammer

miHoYo appeared as the merchant after Chongqing parents paid a fake 648 yuan school charge, creating a striking but potentially misleading clue.

The fraud occurred on August 30, 2026, inside new-student QQ groups at Hanfeng No. 2 Primary School in Chongqing's Kaizhou District. Impostors reportedly copied teachers' names and profile images, then requested payment for school services and class expenses.

Five parents paid, producing a combined reported loss of 3,240 yuan. Yet their Alipay records identified Shanghai miHoYo Yingtie Technology Co., Ltd. as the recipient rather than a school or personal account.

That merchant name turned an established parent-group scam into a much harder payment-security question. Did the money go to miHoYo, to a criminal, or through a legitimate game transaction controlled by someone else?

The available evidence answers only part of that question. The school confirmed the impersonation and reported the case, but investigators have not publicly documented the full payment route.

The receipt therefore matters, but it cannot identify the fraudster by itself. It shows the merchant endpoint used by the transaction, not necessarily the person who created the deception or benefited from it.

What Happened in the 648 Yuan Scam

The verified event is an impersonation scam, while the exact game-payment mechanism remains under investigation.

On September 2, Hanfeng No. 2 Primary School issued a statement about the incident. According to the school's account, criminals entered QQ groups serving first-grade families and conducted a payment scam on August 30.

The school said five parents lost 3,240 yuan in total. It also said the matter had been reported to public security authorities, according to the published school statement.

Screenshots circulating with the story showed accounts presenting themselves as teachers for two first-grade classes. They reportedly requested 448 yuan for after-school services and 200 yuan for class expenses.

That arithmetic produced the unusually recognizable total of 648 yuan. In Chinese mobile games, 648 yuan is widely associated with a standard high-value top-up option.

The notice reportedly used official-sounding language about completing school payments. It also promised an in-school reward for children whose parents paid early.

That reward added urgency without using an overt threat. Parents could reasonably fear that hesitation might disadvantage their children or make them appear uncooperative.

The message included a QR code labeled as a school collection account. Parents who scanned it through Alipay later saw miHoYo's corporate entity in their transaction records.

Some records also reportedly displayed a product description connected to in-game currency. Those details strongly suggest that the QR code opened a real merchant checkout rather than an ordinary personal transfer.

However, public reporting has not established who owned the receiving game account. It has not confirmed who generated the payment request or whether another buyer participated in the transaction.

No publicly available police finding has yet shown that miHoYo organized, knowingly processed, or profited from the fraud beyond receiving a normal game payment. The company has not been identified as a suspect.

That distinction is essential. A criminal can redirect a victim into paying a legitimate merchant for goods delivered to a different person.

In such a transaction, the payment record names the merchant because the merchant fulfilled the checkout. It does not display the identity of the person who lied to the payer.

The timeline also corrects a potential misconception created by the later social-media debate. The fraud happened on August 30, not when the topic began trending several days afterward.

The school's September 2 statement confirmed the reported victim count and aggregate loss. The viral discussion followed, amplified by the coincidence between 648 yuan and a familiar game top-up amount.

Why the Receipt Named miHoYo

A merchant descriptor identifies where a checkout was settled, but it does not prove who engineered the social deception behind it.

Online payments connect several distinct identities. These include the payer, the merchant, the account receiving digital goods, the person sharing the payment code, and any intermediary buyer.

Those identities often belong to the same two parties during a normal purchase. A manipulated transaction can separate them across three or more people.

One plausible structure is a triangulation scam. In that model, a fraudster connects two victims who believe they are participating in unrelated transactions.

First, the criminal obtains or generates a legitimate checkout for digital goods. The goods might be game currency credited to an account controlled by the criminal or another customer.

Second, the criminal gives that checkout code to a different victim. The code is falsely described as a school payment, shopping charge, deposit, or service fee.

Third, the victim pays the legitimate merchant. The merchant delivers the digital goods to the account associated with the original order.

The criminal can then use, resell, or deliver those goods. A third-party buyer might believe the criminal simply provided a discounted top-up service.

This structure explains how a legitimate company can appear in the payment record without being the impersonator. It also explains why the person receiving value may never appear on the payer's receipt.

Game credits are attractive in this context because delivery can be rapid. They are also transferable in economic value through account sales, unofficial top-ups, or other secondary arrangements.

Still, that mechanism has not been officially confirmed for the Chongqing case. It remains an evidence-based hypothesis, not a published investigative conclusion.

Other explanations remain possible. The scammer might have controlled the credited account directly, used a third-party top-up order, or acquired a checkout through another intermediary.

A compromised account is another possibility, although no public evidence currently supports that specific explanation. The QR code's creation history will be more informative than its visible merchant name.

Investigators would need payment-order data to reconstruct the route. Relevant records include the order identifier, creation time, game account, server, device information, IP address, and delivery status.

Platform records might also reveal whether the QR code was static, regenerated, forwarded, or embedded behind another page. Each path creates a different evidentiary trail.

The 648 amount strengthens the game-checkout interpretation because it matched both the alleged school total and a familiar top-up denomination. That neat match may have been deliberately engineered.

A criminal could begin with an available 648 yuan checkout, then invent school charges that add up to the same total. The alleged 448 and 200 yuan components fit that possibility.

The reverse is also possible. The fraudster could have chosen a game order after deciding how much to request from parents.

Without the underlying order record, neither sequence should be presented as established fact. The coincidence is a strong lead, not proof of the criminal's planning process.

This is also why blaming the visible merchant too quickly can obstruct analysis. The merchant may hold useful account and order records while remaining another exploited participant.

The right question is not simply, "Why did miHoYo receive the money?" The better question is, "Who caused the order, who received its value, and who misrepresented it?"

The Real Conflict Is Trusted Identity Versus Payment Reality

The scam succeeded because parents trusted a familiar social identity before checking the independent identity shown by the payment system.

A copied avatar is not authentication. Neither is a familiar display name, writing style, class reference, or apparent knowledge of a teacher's duties.

Criminals can enter loosely managed groups and observe conversations before acting. They can copy teacher profiles, learn school terminology, and wait for a busy payment period.

Police warnings describe this as a recurring opening-season pattern. Fraudsters often exploit groups without strict admission controls, then imitate a teacher and publish a plausible fee notice.

A recent police warning from Huaibei describes a similar sequence. Intruders enter a class group, observe its routines, clone a teacher's account, and post a payment demand.

The Chongqing message reportedly contained several persuasion elements working together. It named recognizable school expenses, supplied a precise total, used teacher identities, and attached a child-focused reward.

Each element reduced the chance that parents would pause. The group setting created another shortcut because visible participation can make a request appear collectively accepted.

Some versions of this scam use accomplice accounts to post fake payment confirmations. Wuhan police have warned that criminals can manufacture apparent group consensus before real parents begin transferring money.

That technique matters because people often treat another person's payment as informal verification. Yet a screenshot or group reply proves neither the sender's identity nor the legitimacy of the charge.

The Wuhan police guidance recommends calling the real teacher rather than messaging the suspicious account. It also advises schools to restrict admissions and remove unknown members.

The payment screen provided a second identity signal in the Chongqing incident. Its merchant name conflicted directly with the story told inside the QQ group.

That mismatch was not a minor billing detail. It was the transaction's strongest warning.

A legitimate school charge should lead through a channel the school has independently announced. Its payee, transaction purpose, and payment instructions should align with that announcement.

A real merchant name does not make a transaction safe when the claimed purpose is unrelated. In fact, an unexpected legitimate merchant can indicate that the payer is funding someone else's purchase.

Parents should therefore treat the final payment screen as a new verification step. They should not view it as a formality following an already trusted conversation.

Three questions should be answered before authorization. Does the merchant match the institution, does the product match the stated charge, and did an independent school channel confirm the request?

If any answer is no, payment should stop. The sender's avatar and urgency cannot resolve a merchant mismatch.

The same rule applies outside schools. A supposed tax payment should not settle to an online retailer, and a rental deposit should not purchase digital credits.

This principle also protects merchants. It encourages payers to detect diverted checkouts before digital goods are delivered and before disputes spread across multiple platforms.

How Parents and Schools Can Break the Scam Chain

The most effective defense is a payment protocol that does not depend on recognizing a social-media profile.

Parents should verify every unexpected fee through a second channel. A phone call to a known number is stronger than a message sent to the account requesting payment.

Do not ask the suspected account whether it is genuine. An impersonator will simply repeat the claim, and a copied profile offers no independent assurance.

Use a school website, verified public account, printed notice, or previously saved phone number. Avoid contact information supplied inside the suspicious message.

Beijing authorities issued a timely warning on August 31, one day after the Chongqing incident. Their school-payment guidance says schools use formal channels and do not normally collect fees through personal group codes.

Parents should also read the complete authorization screen. The merchant, product description, amount, and transaction type each provide a chance to catch inconsistency.

A mismatch should end the payment attempt even when the amount looks correct. Scammers can tailor a false story around the exact amount requested by a real checkout.

Urgency is another warning. Phrases such as "pay immediately," "limited places," or "first participants receive a reward" are designed to replace verification with haste.

School matters involving children create special pressure. Parents may worry that challenging a request will inconvenience a teacher or affect their child's standing.

A well-designed school policy removes that emotional burden. It should explicitly tell families that staff will never penalize them for verifying a payment request.

Schools and teachers carry the other half of the defense. Every class group should require administrator approval and a verifiable parent or guardian identity.

Publicly shared QR invitations should expire quickly or be avoided. A code printed in widely distributed material can become an entry point for outsiders.

Administrators should compare the membership list with official enrollment records. Duplicate teacher identities, unexplained accounts, and generic parent names deserve review.

Schools should publish one stable payment policy before collecting any money. The policy should name approved channels and explain what information parents will see during checkout.

A pinned group notice can state that teachers never post personal payment codes. It should also give families a known phone number for verification.

Hangzhou police recommend identity checks, group admission controls, and immediate evidence preservation. Their parent-group checklist also advises against exposing children's detailed information in public group discussions.

Group administrators should restrict unnecessary changes to shared notices when possible. They should also prevent ordinary members from inviting additional accounts without review.

Teachers need a rapid response procedure when an impostor appears. The first message should tell everyone to stop paying and preserve the original posts.

Deleting the impostor immediately can limit further losses, but evidence should be captured first when safely possible. Useful records include the profile, account identifier, QR code, messages, timestamps, and payment confirmations.

Schools should then contact affected families outside the compromised group. A fraudulent account may remain present or use secondary groups to continue the deception.

Parents who already paid should act quickly. They should contact the payment platform, report the transaction as suspected fraud, and request preservation of associated order information.

They should also call police and provide complete records. Beijing's warning advises victims to preserve chats and transfers, then report the incident immediately.

A platform complaint is not a substitute for a police report. Payment platforms can review transactions, while law enforcement can request account and network records across multiple services.

Victims should not pay anyone who promises a refund for another fee. Recovery scams commonly target people after the original loss becomes public.

They should also avoid confronting a suspected recipient privately. The visible game account or buyer may be an intermediary who does not understand the source of the payment.

Fast reporting improves the chance that platforms can freeze undelivered value or preserve records. It does not guarantee reimbursement, especially when digital goods have already been credited.

What miHoYo's Name Does and Does Not Prove

The receipt supports a game-payment connection, but it does not establish corporate knowledge, criminal intent, or the final beneficiary.

The strongest confirmed fact is narrow. Parents who believed they were paying school charges reportedly authorized transactions displaying a miHoYo-related corporate merchant.

That fact deserves investigation because it points to a specific commercial order. It does not justify treating the merchant descriptor as the name of the scammer.

A merchant processes the purchase described by its own checkout system. It usually does not see the unrelated story that another person used to persuade the payer.

If the QR code represented a genuine game order, miHoYo's systems may have received a technically valid authorization. The social fraud occurred upstream, inside the parent group.

That separation does not eliminate every platform question. Digital merchants still face pressure to detect suspicious ordering patterns and cooperate quickly when victims report redirected payments.

Investigators may examine repeated orders, account age, device changes, redemption speed, and links between game accounts. Those signals can help distinguish ordinary play from abuse.

However, the public record does not show what controls operated on these transactions. It also does not establish whether the credited accounts were frozen or the digital goods recovered.

There is no verified public evidence that miHoYo supplied the school-themed code, entered the parent group, or communicated with the families. Claims implying otherwise go beyond the available facts.

There is also no published evidence that Alipay knowingly presented the transaction as a school payment. The reported screen apparently showed the merchant information that exposed the mismatch.

The controversy illustrates a broader problem with merchant-of-record assumptions. Consumers often believe the receipt's named company must also be their direct counterparty.

That assumption works for ordinary shopping. It fails when a criminal forwards another person's checkout or disguises a merchant order as something unrelated.

Digital-goods systems face particular recovery difficulties. Unlike a physical package, game currency can be credited immediately and consumed before anyone reports fraud.

Yet digital delivery also creates records. An account, server, order time, device, and login history may form a traceable chain for investigators.

The case therefore places pressure on every participant without assigning equal blame. Schools must protect group access, payment platforms must preserve transaction evidence, and merchants must identify the credited account.

Parents need clear verification habits, but the answer cannot be to blame victims for trusting a familiar teacher profile. The scam was designed around that trust.

The number 648 made the incident culturally recognizable, but it should not distract from the security failure. A copied identity was allowed to trigger a real payment outside an authenticated school process.

A similar weakness existed in Kaizhou years earlier. In 2020, local authorities described a suspect who copied a teacher's identity and defrauded 31 parents after gaining access to a group.

That earlier Kaizhou case involved 6,200 yuan and shows that teacher impersonation is not a new technique. The delivery channel has changed more than the underlying manipulation.

The lasting lesson is not that game companies secretly collect school fees. It is that legitimate payment infrastructure can be placed behind a fraudulent story.

Three Signals That Will Clarify the 648 Case

The next meaningful developments will come from transaction records, the credited accounts, and any coordinated recovery action.

The first signal is a police description of the payment chain. Investigators need to establish who created each order and which game account received the corresponding value.

That finding would confirm or reject the triangulation explanation. It would also reveal whether the scammer controlled the accounts directly or served outside buyers.

The second signal is a platform or merchant response tied to identifiable orders. Useful disclosure would address whether the transactions were located, preserved, frozen, refunded, or linked to other activity.

A general anti-fraud statement would add little. The important evidence concerns these five payments and the accounts credited after them.

The third signal is a change in school group and payment controls. Hanfeng No. 2 Primary School and other schools can reduce repeat risk through verified membership and fixed collection channels.

These signals matter beyond one 3,240 yuan loss. They will show whether the system can connect social impersonation evidence with merchant and account records quickly enough to recover value.

Until investigators publish that chain, the cautious conclusion remains straightforward. The miHoYo receipt is credible evidence about where the payment settled, not proof of who committed the scam.

For parents, the practical rule is even simpler. Stop whenever a school notice and its payment screen tell two different stories.

Verify the fee using a known phone number, inspect the final merchant and product, and save all records if anything looks wrong. If payment already occurred, contact the platform and police immediately.

The memorable detail may be 648 yuan. The reusable defense is independent verification before every school-related payment.