- Access Workaround: Chinese users keep reaching Claude through transfer stations and seller channels despite Anthropic restrictions.
- Proxy Mechanism: Transfer stations route application programming interface requests through intermediaries and can take Chinese renminbi payments at reported discounts.
- Traceability Gap: Anthropic uses identity checks and account bans, but proxy accounts can obscure the human behind each prompt.
- User Risk: Proxy routing can expose prompts and code context, while systematic log resale and model substitution remain only partly verified.
After AI company Anthropic expanded identity checks for its Claude AI models in April 2026, Chinese users are still buying cheap access through proxy services and account sellers, turning China restrictions into an unofficial token market with privacy and safety trade-offs. Transfer-station sellers advertise 10% of official cost and route prompts through intermediaries. Proxy resale can leave prompts, tool calls, and repository context passing through operators that are not Anthropic.
Because the official access path to Claude excludes China, transfer stations, unofficial API proxies, turn that gap into a service model for Chinese users. A buyer sends a prompt to an intermediary. An overseas API account thencarries the request to Claude and returns the response through the same proxy path.
As the workaround spread, one online joke captured the mood: “We are all Singaporean from time to time.” Low price and Chinese renminbi payment convenience can put prompts, tool calls, repository context, and model outputs in the hands of intermediaries.
Anthropic’s public boundary is clearer than the market around it: China is absent from its supported countries and regions. Claude support guidance says identity verification can require a government ID, a live selfie, and Persona, the identity-verification provider used in the Claude flow. Anthropic frames the checks as a safety requirement: “Being responsible with powerful technology starts with knowing who is using it.”
How Transfer Stations Turn Restrictions Into a Market
When a transfer station functions as an access broker, operators package overseas API capacity as local subscriptions or token balances. They take renminbi payments through WeChat or Alipay instead of requiring a foreign phone number, overseas card, or direct Anthropic account.
Because lower prices can come from account arbitrage rather than lower model costs, operators can combine free-credit accounts and unused quota with corporate or education discounts, Max-plan sharing, and fraudulent payment accounts. Public comparison lists shared online also make the market visible by cataloging provider names, model support, and pricing, turning an initial workaround into something closer to a browsing market without making it official.
Anthropic’s Enforcement Push Meets Identity Workarounds
Because Anthropic treats proxy abuse as a licensing and safety problem, its enforcement push reaches beyond account location. In September 2025 it extended its unsupported-region sales restriction to organizations majority-owned by companies headquartered in places outside its access policy. Separately, Anthropic said proxy networks helped run distillation campaigns, using one model’s outputs to train or copy another, involving more than 20,000 fraudulent accounts and more than 16 million exchanges with Claude.
After Claude identity checks appeared, seller channels adapted, while Chinese-language channels advertised accounts that had already passed verification.
When seller channels separate account identity from the buyer, enforcement shifts to a harder traceability problem. Cybercrime investigator found discussions about bypassing Anthropic’s geolocation restrictions by buying KYC-verified accounts. Reseller channels can leave Anthropic monitoring location and account pools rather than the actual buyer behind the prompt.
The Privacy and Model-Substitution Risk
Even when the model behind the service is genuine, proxy routing creates a separate user risk. Every request can expose prompts and repository context to the proxy operator, along with responses, tool calls, iterations, and human-verified outputs.
Although developer communities assert that logs are reused in some cases, systematic log resale remains unverified. Model identity is another weak point: researchers studying shadow APIs, third-party services claiming indirect access to official models, found that three representative services showed up to 47.21% performance divergence plus identity-verification failures in fingerprint tests.
Proxy routing leaves the safety issue centered on the person behind each request, not just the account location:
“People who are working on AI safety need to think, if this transfer station infrastructure remains, how are you going to monitor bad actors and prevent them from doing bad things?”
Oxford China Policy Lab research associate (via WIRED)
Intermediary routing can leave Anthropic seeing proxy accounts instead of the real user, while users may have no reliable way to verify which model answered or what happened to their prompts.
Because Claude remains valuable to programmers, demand persists despite those risks. For coding work, researchers argue that Chinese models still lag US systems, and academics and engineers at Chinese tech companies preferred Claude. Local model competition so fardoes not remove the appetite for official-quality Claude access.
Anthropic’s next enforcement signal probably will be a verified account-to-human match before a reseller carries the buyer’s prompt, code repository, or tool call through the proxy market.
