ReportWire

Tag: Privacy

  • Hackers push fake apps with malware in Google searches

    [ad_1]

    NEWYou can now listen to Fox News articles!

    When you search Google for apps, it feels natural to trust the first results you see. They’re supposed to be the most reliable, right? Unfortunately, hackers know this too. They’re sneaking fake websites into search results that look just like the real thing. If you click and download from one of these sites, you could end up with malware instead of the app you wanted. In other words, the top search results aren’t always safe, and that’s exactly how scammers trick people.

     Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    NORTH KOREAN HACKERS USE AI TO FORGE MILITARY IDS

    What you need to know about malware in Google searches

    Researchers at FortiGuard Labs found that attackers are setting up websites that look almost identical to trusted providers. These sites host installers for apps like Signal, WhatsApp, Deepl, Chrome, Telegram, Line, VPN services and WPS Office. The catch is that these downloads include both the real app and hidden malware.

    Once you run one, the malware drops files into your system, asks for administrator access and quietly starts spying. It can collect personal information, log everything you type, monitor your screen and even disable your antivirus.

    Hackers are planting fake apps in Google search results and they look just like the real thing. (Harun Ozalp /Anadolu via Getty Images)

    Some versions were designed to snoop on Telegram messages. All of this is possible because hackers use a tactic called SEO poisoning, which manipulates Google’s search results so their fake websites appear near the top. Even if you stick to “safe-looking” search links, you could still land on a fraudulent page.

     How hackers disguise fake apps as real ones

    So how do these fake sites end up in your search results in the first place? The attackers use a technique called SEO poisoning. They register lookalike domains, use plugins to game search algorithms and then climb up Google’s rankings. That way, when you search for a trusted app, the fake site may appear as one of the first results.

    According to FortiGuard Labs, this particular campaign mainly targeted Chinese-speaking users, but the method is being used everywhere. In fact, earlier reports from Cisco Talos showed ransomware groups pushing fake downloads of AI tools like ChatGPT or InVideo. Others used spoofed sites for PayPal, Microsoft, Netflix and Apple. Sometimes, attackers even buy sponsored ads so that their malicious links appear right at the top.

    The scary part is that you might not even realize you installed something dangerous. Because the fake installer includes the real app, everything seems to work fine. Meanwhile, the hidden malware is already active on your device. That makes it harder to detect and much easier for attackers to steal your data.

    6 ways you can stay safe from malware in Google Searches

    I have listed some steps below that you can take to protect yourself from these fake apps and the malware they carry.

    1) Download apps only from official sources

    The safest way to avoid malware is to get software directly from the official website or verified app stores like Google Play or the Apple App Store. Avoid third-party download sites or search results that look suspicious, even if they appear at the top of Google.

    2) Double-check website domains

    Before clicking “download,” carefully inspect the domain name. Hackers often create lookalike domains that look nearly identical to real ones, adding small spelling changes or extra words. Even small differences can indicate a fake site designed to deliver malware.

    TOP 5 OVERPAYMENT SCAMS TO AVOID

    Google search on a laptop screen.

    Cybercriminals are disguising malware as trusted apps, tricking users through poisoned search results. (Dilara Irem Sancar/Anadolu via Getty Images)

    3) Install a reliable antivirus software

    Malware can install itself quietly and avoid detection. Using a strong antivirus solution can help identify and block malicious files before they cause damage. Make sure your antivirus is always updated so it can recognize the latest threats, including Hiddengh0st and Winos variants.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    4) Use a password manager

    If malware tries to capture your passwords, a password manager can protect you. It generates strong, unique passwords for each account and stores them securely. Many password managers can also alert you if your credentials appear in a data breach.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    5) Be cautious with ads in search results

    Attackers sometimes buy sponsored Google ads to push malware. Even if an ad looks like it comes from a trusted brand, verify it carefully before clicking. Stick to official websites whenever possible.

    6) Keep your software and system updated

    Outdated operating systems and applications can have vulnerabilities that malware exploits. Regularly updating your software ensures you have the latest security patches and reduces the risk of infection.

    HOW RETIREES CAN STOP FAKE DEBT COLLECTOR SCAMS

    Google search on a smartphone.

    SEO poisoning is letting hackers hijack Google results targeting user’s data. (Nicolas Economou/NurPhoto via Getty Images)

    Kurt’s key takeaway

    Hackers are turning Google search into their delivery system for malware. By blending real apps with hidden spyware, they can make almost anyone a victim. The rise of SEO poisoning shows that you cannot rely only on search rankings to stay safe. If you are careful about where you download your apps, you can keep your devices and data out of a hacker’s hands.

    CLICK HERE TO GET THE FOX NEWS APP

    How much do you trust Google to filter out malicious sites before you click? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Where Do Your Passwords Go When You Die?

    [ad_1]

    It’s not fun to talk about, but there’s only one thing certain in life. You need to have a plan for your digital legacy, just like you make a plan for your physical assets; otherwise, your accounts, services, and logins will rot away in a data center before they’re inevitably erased by a data retention policy.

    Some services recognize how important digital legacy is. Apple and Facebook have legacy contacts that can gain access to your accounts, and the American Bar Association is still grappling with the legalities of accessing online accounts when someone passes away. Most online services don’t.

    Recognition of digital legacy is still spotty, and without dedicated legacy contacts, accessing the deceased’s online accounts often involves court orders or legal documentation (and plenty of time). Digital legacy doesn’t need to have so many hurdles, though. Password managers have digital legacy features built in that can unlock your digital life in the event of an emergency.

    Table of Contents

    Defining a Digital Legacy

    There’s a lot that goes into your digital legacy, from your online banking login to any digital assets you own, but even a seemingly straightforward online life can quickly snowball into a mess. Does the Netflix account just keep draining the checking account until you can break in and change the payment option? Are photos that have been uploaded to the cloud now lost in a data center, never to be recovered? Add some passkeys, maybe some social sign-on features, and you have a complex web of data that’s almost impossible to untangle.

    So-called digital executors exist, operating in the same way as the executor of the will, just for digital assets. It’s a good idea to set up a digital executor to ensure your digital assets are handled properly, but that doesn’t help in the immediate aftermath of someone passing away. The probate process can take at least a few months, and sometimes several years.

    Password managers like Bitwarden offer a shortcut. You can transfer access to a trusted relative, spouse, or even your closest friend, along with a rundown of what to do with your accounts.

    The legality of this is a little murky, with the American Bar Association noting that accessing someone else’s account, even with their username and password, isn’t legal if it violates the platform’s terms of service. The law regarding digital assets varies from state to state, so it’s still a good idea to consult an attorney for long-term access.

    Here’s the advice NordPass gave: “For anyone thinking about digital legacy, the best step is to set up Emergency Access in advance, clearly communicate the use cases of the credentials with your trusted contacts, and follow the terms of service of respective platforms.”

    Immediate access is still important, not only in the event of death but also in the event of incapacitation. If you, for whatever reason, can’t access your online accounts, you can transfer those accounts easily using an emergency contact feature available in a password manager.

    Password Managers With Digital Legacy Features

    There are some excellent password managers, and most of them have some way to unlock your account in the event of an emergency. They go about it in different ways, however. Here are the three I recommend for most people. (Read more in our Best Password Managers guide.)

    Proton Pass

    Courtesy of Proton

    Proton recently added an emergency access feature, and it’s not just restricted to Proton Pass. Unlike most password managers, Proton Pass is just one app available in the Proton suite. Proton also makes our favorite VPN, and it offers an encrypted crypto wallet, cloud storage, and even a calendar.

    Emergency access isn’t restricted to one app with Proton. Rather, it’s access to your entire account, so if you have multiple Proton apps, you can pass them along. It’s not hard to see where this could be useful, especially if you have a lot of data stored in Proton Drive or money in your crypto wallet.

    [ad_2]

    Jacob Roach

    Source link

  • Proton Pass Finally Has the Goods to Compete With Other Password Managers

    [ad_1]

    You can rename your vaults, but you can also assign them one of a few dozen icons, as well as choose from a handful of color presets. It’s a small addition, but a little color-coding goes a long way in finding what you need at a glance.

    Beyond logins, you can also generate and store email aliases, similar to NordPass. It’s a standard feature, even if you don’t subscribe. Free users are capped at 10 aliases, while paying users can create as many as they want.

    It’s not just a fake email tied to a real one. You can set up aliases like that, but Proton allows you to forward emails to multiple addresses, create catch-all addresses, and even reply directly from the web app. I appreciate the activity log most, though. Proton automatically creates contacts for everyone who interacts with your alias, and you can block spammy addresses without ever opening your email client.

    No Desktop App

    Proton Pass via Jacob Roach

    Proton Pass was originally available only as a browser extension, but it now has apps for Windows, macOS, and even Linux, as long as you’re on a Fedora- or Debian-based distribution. I mainly used Pass in the browser, not only because it’s convenient but also because the extension is available on just about everything—Chromium-based browsers have access, and there are separate extensions for Firefox, Safari, and Brave.

    The browser app has everything you need, and it works a treat when it comes to password capture and autofill. Proton occasionally asked me to save a password a second time after initially dismissing a capture notification. But outside of that small hiccup, I never encountered an issue with autofill for forms, logins, or credit cards.

    Inside the app, you have a few features that aren’t available through the extension. The key feature is Pass Monitor, which is Proton’s security watchdog feature. It’ll show you weak passwords, accounts where you can enable 2FA, and critically, accounts that have been victims of a data breach. If you want to go further, you can turn on Proton Sentinel, as well.

    Pass Monitor is great, but breach notifications have a problem. By default, Proton only monitors the email associated with your Proton account. If you’re importing passwords from another app, as I did, and you have different emails, those aren’t a part of the monitoring by default. And Proton doesn’t tell you that. You have to click into breach details and manually add addresses.

    Proton Pass Review Finally Standing Tall

    Proton Pass via Jacob Roach

    [ad_2]

    Jacob Roach

    Source link

  • An App Used to Dox Charlie Kirk Critics Doxed Its Own Users Instead

    [ad_1]

    New research released this week shows that over the past few years the US Department of Homeland Security has collected DNA data of nearly 2,000 US citizens. The activity raises questions about legality and oversight given that DHS has been putting the information into an FBI crime database. Some of the genetic data is from US citizens as young as 14.

    The US Secret Service said on Tuesday that it had discovered facilities across the “New York tristate area” running so-called SIM servers—devices that manage and coordinate 100,000 SIM cards at a time for illicit operations. The Secret Service warned, though, that in addition to being used by cybercriminals for scamming, the apparatuses could also be used to launch critical infrastructure attacks that could disrupt mobile networks.

    A cyberattack on the UK-based automaker Jaguar Land Rover has been causing a supply chain meltdown, halting vehicle production, costing JLR tens of millions of dollars, and forcing its parts suppliers to lay off workers. The beleaguered company will have to shoulder the full cost of the attack because of inadequate insurance coverage, prompting talks of possible UK government assistance.

    If you’re worried about phone searches while traveling or doing specific activities, the password manager known as 1Password has a Travel Mode feature that can help you manage sensitive data and temporarily remove it from your device. We’ve got advice on how to use the tool most effectively.

    And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    An app used to out those who spoke ill of the murdered right-wing activist Charlie Kirk was found to be leaking its users’ personal information, doxing the very people it had invited to dox its targets.

    The app Cancel the Hate, founded in the wake of Kirk’s September 10 assassination, suspended its services this week after it was revealed that security flaws in the website where the app was hosted exposed users’ email addresses and phone numbers. That site had asked its users to collect and share employment and other personal information of critics of Kirk and others “supporting political violence.” But a security researcher who identified themselves only as BobDaHacker demonstrated to news outlet Straight Arrow News that privacy settings on the site didn’t work as advertised, publicly leaking users’ information even when it was set to private. The hacker also reportedly had the ability to delete users’ accounts at will.

    Cancel the Hate, which displayed a photo of Kirk on its homepage and was founded by a Kirk supporter who cited his death as the motivation for creating the site, has since taken down its reporting features. It now displays a message on its homepage that it’s moving to a “new service provider.” The page that allows visitors to buy a $23 T-shirt remains online.

    Ransomware groups continued to plumb the depths of abject immorality this week with a new tactic: extorting preschools by stealing toddlers’ personal information and threatening their parents. The BBC reports that a hacker group says it has stolen the names, addresses, and photos of around 8,000 children from the preschool chain Kido, which has sites largely around London but also in the US and India. The hackers are threatening to leak the data if a ransom isn’t paid, going so far as to contact some of the children’s parents to reinforce their threat. The group has also posted sample information and photos of 10 children on their dark-web site.

    In August, The Guardian, Israeli-Palestinian publication +972 Magazine, and Hebrew-language publication Local Call revealed how Israeli signals intelligence agency Unit 8200 had built a comprehensive surveillance system to intercept and store Palestinian phone calls. More than “a million calls an hour” could be collected by the system, which reportedly amassed around 8,000 terabytes of call data and stored it in Microsoft’s Azure cloud service in the Netherlands, the publications reported.

    This week, following an external investigation commissioned by Microsoft, the company pulled some of the Israeli military’s access to its technology. In a statement, Microsoft president Brad Smith said the firm has taken the decision to “cease and disable” some “specific cloud storage and AI services and technologies” that it was providing to Israeli forces. Microsoft’s action—its investigation is still ongoing—follows a wave of staff protests at its ties to Israel and its ongoing war in Gaza. “We do not provide technology to facilitate mass surveillance of civilians. We have applied this principle in every country around the world, and we have insisted on it repeatedly for more than two decades,” Smith wrote in a statement.

    [ad_2]

    Andy Greenberg, Matt Burgess, Lily Hay Newman

    Source link

  • North Korean hackers use AI to forge military IDs

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A North Korean hacking group, known as Kimsuky, used ChatGPT to generate a fake draft of a South Korean military ID. The forged IDs were then attached to phishing emails that impersonated a South Korean defense institution responsible for issuing credentials to military-affiliated officials. South Korean cybersecurity firm Genians revealed the campaign in a recent blog post. While ChatGPT has safeguards that block attempts to generate government IDs, the hackers tricked the system. Genians said the model produced realistic-looking mock-ups when prompts were framed as “sample designs for legitimate purposes.”

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CyberGuy.com/Newsletter 

    Example of an AI-Generated Virtual ID card. (Genians)

    How North Korean hackers use AI for global espionage

    Kimsuky is no small-time operator. The group has been tied to a string of espionage campaigns against South Korea, Japan and the U.S. Back in 2020, the U.S. Department of Homeland Security said Kimsuky was “most likely tasked by the North Korean regime with a global intelligence-gathering mission.” Genians, which uncovered the fake ID scheme, said this latest case underscores just how much generative AI has changed the game.

    “Generative AI has lowered the barrier to entry for sophisticated attacks. As this case shows, hackers can now produce highly convincing fake IDs and other fraudulent assets at scale. The real concern is not a single fake document, but how these tools are used in combination. An email with a forged attachment may be followed by a phone call or even a video appearance that reinforces the deception. When each channel is judged in isolation, attacks succeed. The only sustainable defense is to verify across multiple signals such as voice, video, email, and metadata, in order to uncover the inconsistencies that AI-driven fraud cannot perfectly hide,” Sandy Kronenberg, CEO and Founder of Netarx, a cybersecurity and IT services company, warned.

    Metadata of the PNG File

    North Korea is not the only country using AI for cyberattacks.

    HACKER EXPLOITS AI CHATBOT IN CYBERCRIME SPREE

    Chinese hackers also exploit AI for cyberattacks

    North Korea is not the only country using AI for cyberattacks. Anthropic, an AI research company and the creator of the Claude chatbot, reported that a Chinese hacker used Claude as a full-stack cyberattack assistant for over nine months. The hacker targeted Vietnamese telecommunications providers, agriculture systems and even government databases.

    According to OpenAI, Chinese hackers also tapped ChatGPT to build password brute-forcing scripts and to dig up sensitive information on US defense networks, satellite systems and ID verification systems. Some operations even leveraged ChatGPT to generate fake social media posts designed to stoke political division in the US.

    Google has seen similar behavior with its Gemini model. Chinese groups reportedly used it to troubleshoot code and expand access into networks, while North Korean hackers leaned on Gemini to draft cover letters and scout IT job postings. 

    GOOGLE AI EMAIL SUMMARIES CAN BE HACKED TO HIDE PHISHING ATTACKS  

    Illustration of attack Scenario

    The above features an ilustration of a hackers’ attack scenario. (Genians)

    Why AI-powered hacking threats matter now

    Cybersecurity experts say this shift is alarming. AI tools make it easier than ever for hackers to launch convincing phishing attacks, generate flawless scam messages, and hide malicious code.

    “News that North Korean hackers used generative AI to forge deepfake military IDs is a wake-up call: The rules of the phishing game have changed, and the old signals we relied on are gone,” Clyde Williamson, Senior Product Security Architect at Protegrity, a data security and privacy company, explained. “For years, employees were trained to look for typos or formatting issues. That advice no longer applies. They tricked ChatGPT into designing fake military IDs by asking for ‘sample templates.’ The result looked clean, professional and convincing. The usual red flags — typos, odd formatting, broken English — weren’t there. AI scrubbed all that out.” 

    “Security training needs a reset. We need to teach people to focus on context, intent and verification. That means encouraging teams to slow down, check sender info, confirm requests through other channels and report anything that feels off. No shame in asking questions,” Williamson added. “On the tech side, companies should invest in email authentication, phishing-resistant MFA and real-time monitoring. The threats are faster, smarter and more convincing. Our defenses need to be too. And for individuals? Stay sharp. Ask yourself why you’re getting a message, what it’s asking you to do and how you can confirm it safely. The tools are evolving. So must we. Because if we don’t adapt, the average user won’t stand a chance.”

    HOW AI CHATBOTS ARE HELPING HACKERS TARGET YOUR BANKING ACCOUNTS

    How to protect yourself from AI-powered scams

    Staying safe in this new environment requires both awareness and action. Here are steps you can take right now:

    1) Slow down, verify, and use strong antivirus

    If you get an email, text or call that feels urgent, pause. Verify the request by contacting the sender through another trusted channel before you act. At the same time, protect your devices with strong antivirus software to catch malicious links and downloads.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at CyberGuy.com/LockUpYourTech 

    2) Use a personal data removal service

    Reduce your risk by scrubbing personal information from data broker sites. These services can help remove sensitive details that scammers often use in targeted attacks. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan 

    3) Check sender details carefully

    Look at the email address, phone number or social media handle. Even if the message looks polished, a small mismatch can reveal a scam.

    4) Use multi-factor authentication (MFA)

    Turn on multi-factor authentication (MFA) for your accounts. This adds an extra layer of protection even if hackers steal your password.

    5) Keep software updated

    Update your operating system, apps and security tools. Many updates patch vulnerabilities that hackers try to exploit.

    6) Report suspicious messages

    If something feels off, report it to your IT team or your email provider. Early reporting can stop wider damage.

    7) Question the context

    Ask yourself why you are receiving the message. Does it make sense? Is the request unusual? Trust your instincts and confirm before taking action.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaways

    AI is rewriting the rules of cybersecurity. North Korean and Chinese hackers are already using tools like ChatGPT, Claude, and Gemini to break into companies, forge identities, and run elaborate scams. Their attacks are cleaner, faster, and more convincing than ever before. Staying safe means staying alert at all times. Companies need to update training and build stronger defenses. Everyday users should slow down, question what they see, and double-check before trusting any digital request.

    Do you believe AI companies are doing enough to stop hackers from misusing their tools or is the responsibility falling too heavily on everyday users? Let us know by writing to us at CyberGuy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CyberGuy.com/Newsletter

    Copyright 2025 CyberGuy.com.  All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Retail Stores May Soon Use Drones to Chase Thieves

    [ad_1]

    As if we weren’t already tracked enough, malls and stores across the U.S. might soon deploy drones to catch shoplifters.

    Controversial surveillance company Flock Safety, which supplies drones and other invasive tech to police departments, announced on Thursday that it is now offering its drones to private security firms.

    Drone use in policing is on the rise, and this move makes it likely that private companies will soon adopt the same tech. But as drones become normalized for public and private security, privacy advocates warn they could push the U.S. closer to a surveillance state.

    “Security leaders are being asked to protect more with less across bigger footprints, tighter budgets, and real staffing constraints,” Rahul Sidhu, Flock Safety’s VP of Aviation, said in a press release.

    The company says each drone dock can cover roughly a 3.5-mile radius with flight times up to 45 minutes, providing rapid response for warehouses, rail yards, hospitals, ports, malls, and business centers.

    In its press release, Flock Safety pitched its drones specifically to retail stores, arguing that organized retail crime remains high. It cited an industry report showing that retailers saw a 93% increase in shoplifting incidents in 2024, and said the drones’ quick response could help reduce related costs over time. Of course, it’s worth noting that retailers’ claims of a shoplifting epidemic were largely debunked in 2024, but that didn’t stop police departments from going on a shopping spree for new toys.

    Keith Kauffman, Flock’s drone program director, told the MIT Technology Review how the drones could work in practice.

    When a store’s security team spots shoplifters leaving the scene, they can activate the drone, which is docked on the roof. Equipped with video and thermal cameras, the drone can track thieves escaping on foot or in a vehicle. Its video feed can then be sent to the company’s security team and transmitted directly to local police.

    Flock’s technology is already in use in many police departments. Just this week, its license plate cameras were credited with catching a murder suspect in El Paso and locating a missing teen in Boulder, Colorado.

    But not everyone is thrilled with the company’s tech. The city of Evanston, Illinois, ordered Flock Safety this week to uninstall 18 license plate readers after Secretary of State Alexi Giannoulias discovered that Flock had given U.S. Customs and Border Protection access to the readers’ data. And in August, Congress launched an investigation into what one member called Flock’s “role in enabling invasive surveillance practices that threaten the privacy, safety, and civil liberties of women, immigrants, and other vulnerable Americans.”

    ACLU Senior Policy Analyst Jay Stanley has warned in recent years that the expanding use of drones in policing and private security requires strict privacy guardrails, including limits on when and where drones can be used and how video and other sensor data are handled.

    “We don’t want to end up in a nightmare scenario where drones are used for mass surveillance and the experience of having police flying cameras buzzing overhead becomes routine in people’s daily lives,” Stanley wrote in a recent blog post.

    [ad_2]

    Bruce Gil

    Source link

  • Neon, an App That Pays to Record Your Phone Calls Hit #2 on the App Store, Taken Down Over Security Flaw

    [ad_1]

    After coming out of nowhere, a viral new app that pays people to record their phone calls for the purpose of training AI has been yanked offline after a security flaw allegedly exposed user data.

    Neon founder Alex Kiam told Gizmodo in an email that the app’s servers are down while the team patches the vulnerability and conducts a security audit to ensure the issue doesn’t happen again.

    Neon launched just last week and quickly shot to the number two spot on iPhone’s top free app chart before it was taken down on Thursday.

    The app pays users who agree to record their calls and lets Neon sell those recordings and other data to AI companies to train their models and voice assistants. It was pitched as a way for people to earn some money from their data, which tech companies have long profited from.

    “Companies collect and sell your data every day. We think you deserve a cut,” the company’s website says.

    Things took a turn on Thursday after TechCrunch discovered and reported a major flaw that let nearly anyone access sensitive Neon user data, including phone numbers, call recordings, and transcripts.

    While testing the app, TechCrunch used the network-traffic tool Burp Suite to analyze the data coming in and out of the app. Neon’s interface only shows a simple list of a user’s recent calls and how much each earned. However, Burp Suite was able to get a lot more info from the app’s back-end servers, like full call transcripts and public links to the raw audio files from other users’ calls.

    Probing further, TechCrunch reporters discovered they could also access call metadata from other users. That information included both parties’ phone numbers, the time and duration of a call, and how much each call earned.

    Kiam said the Neon team shut down the app’s servers immediately after TechCrunch alerted them to the flaw.

    In an email to users, the company said it expects to be back online soon.

    “Your data privacy is our number one priority, and we want to make sure it is fully secure even during this period of rapid growth,” the email reads. “Because of this, we are temporarily taking the app down to add extra layers of security.”

    How Neon Works

    Users sign up with their phone number and grant Neon permission to record calls made via the app. Every time they place or receive a call from the app, it automatically records both sides of the conversation if the other party also uses Neon, or, in theory, just the Neon user’s side if the person isn’t on the app.

    The recordings and related data are then supposed to be anonymized—stripped of identifying details—and sold to vetted AI and data partners. Users earn $0.30 per minute for calls with another Neon user or $0.15 per minute when calling a non-user, capped at $30 a day.

    [ad_2]

    Bruce Gil

    Source link

  • Top 5 overpayment scams to avoid

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Overpayment scams are on the rise, and they can leave victims thousands of dollars in debt. The setup usually looks harmless: someone sends you a check for more than the agreed amount, asks you to forward the difference and disappears once the check bounces. Below are five of the most common overpayment scams you need to watch for today.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    FBI WARNS SENIORS ABOUT BILLION-DOLLAR SCAM DRAINING RETIREMENT FUNDS, EXPERT SAYS AI DRIVING IT

    1. The dog walker overpayment scam

    Bob from Harrison, Ohio, recently shared how he was nearly tricked by a scammer posing as a pet owner. The con began with a request for dog sitting. Bob was promised $250 for care and food, but then a fake check for $4,358 arrived.

    The scammer instructed Bob to send $4,000 of it to an “appliance retailer.” Why an appliance retailer when the service was for dog sitting? Scammers often use a third party to make the request sound more believable. If they simply asked for the money back, it would raise red flags. By inventing another company, whether a retailer, shipping service or contractor, they add urgency and legitimacy to the story. In reality, that “retailer” is just another front that the scammer controls. Here’s the catch: the check appears to be real, but it’s actually counterfeit. The bank may release the funds temporarily, but once it bounces, you’re on the hook for the entire amount.

    Making a payment by scanning a QR code with a phone. (Kurt “CyberGuy” Knutsson)

    Tip: If you’re asked to forward money to a third party, especially one unrelated to the original deal, treat it as a scam. Keep the check and envelope as evidence, and report it to the FTC and your state attorney general.

    2. The online marketplace scam

    Selling a couch, bike or electronics online? Some buyers “accidentally” send too much. They then ask you to return the difference through Zelle, Venmo or a wire transfer. Once the check or payment reverses, you’ve lost both the product and the money you returned.

    Tip: Always insist on verified payment methods. If a buyer pushes you for a refund quickly, walk away. 

    FAKE AGENT PHONE SCAMS ARE SPREADING FAST ACROSS THE US

    A woman shopping for clothes

    Scammers may try to recruit buyers into buying gift cards before a false check they provided bounces. (Kurt “CyberGuy” Knutsson)

    3. The mystery shopper scam

    You might get an email or letter offering a job as a mystery shopper. They send you a large check to “test” stores by buying gift cards. You’re asked to send the gift card numbers back as proof of purchase. After the bank reverses the fake check, you’ve lost the money you spent on those gift cards.

    Tip: Real companies never pay upfront with extra funds or ask for gift card codes by email.

    4. The rental deposit scam

    Scammers target renters by mailing a check for more than the deposit or rent. They claim it was a mistake and ask you to refund the difference. The check later bounces, leaving you stuck.

    Tip: Only accept payments through secure online portals or in person with verified funds.

    5. The work-from-home equipment scam

    This one lures jobseekers. The “employer” sends a large check to buy office equipment, then directs you to forward the extra funds to a vendor. Of course, the check is fake, and the supposed vendor is also the scammer.

    Tip: Legitimate employers provide equipment directly or reimburse verified expenses, not through overpayments.

    CLICK HERE TO GET THE FOX NEWS APP

    Treadmill desk

    Scammers target remote workers by promising to provide a stipend for work-from-home tech. (iStock)

    How to protect yourself from overpayment scams

    Now that you’ve seen how these scams play out, from fake dog sitting gigs to marketplace frauds and bogus job offers, it’s clear they all follow the same playbook. Someone sends you too much money and pressures you to forward the extra. That “extra” never existed, and once the check bounces, you’re left holding the bag. The good news is, there are clear steps you can take to protect yourself and keep your money safe.

    Pause before acting

    Every scam in this article, from the dog walker hoax to rental deposit tricks, begins with an overpayment that looks harmless. If someone pays you more than you’re owed, it’s not a mistake. It’s a scam. Do not respond or send money to any third party. Save the check and envelope as evidence, then report it.

    Verify funds with your bank

    Scammers count on you trusting what you see in your account. In Bob’s case, his $4,358 check looked real because the bank showed it as “available.” But available isn’t the same as cleared. Always ask your bank to confirm when funds are fully verified before you spend a dime. 

    Avoid rushing

    Urgency is the scammer’s strongest weapon. Marketplace fraudsters, renters and fake employers will pressure you to “fix” the mistake right away. Slow down, double-check and don’t let anyone force you into quick action. 

    Use secure payment systems

    Whether it’s for rent, freelance work or selling a used item, scammers prefer paper checks because they’re easy to fake. Stick with secure, traceable payment platforms or in-person verified funds. That way, you don’t get stuck when a check bounces.

    Keep records of all communication

    If you receive a suspicious check, save everything: the envelope, emails, texts and any names used. In the dog sitting scam, Bob’s saved emails and the scammer’s phone number became valuable evidence. This documentation helps law enforcement and protects you if the scammer tries again under another identity.

    Use a personal data removal service

    Scammers often find victims by scraping personal details from online data brokers. That’s how they target renters, pet sitters or jobseekers. Using a personal data removal service can limit your exposure and make you harder to target in the first place. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    Enable fraud alerts with your bank

    Many banks let you set fraud alerts for large deposits or unusual transactions. Turning these on gives you a chance to review suspicious activity before a scammer pressures you into acting on it.

    Report scams

    Just like Bob did when he cut contact with the fake pet owner, reporting scams helps protect others. File with the Federal Trade Commission (FTC) at reportfraud.ftc.gov and your state attorney general. You can also alert your local police and community groups to stop scammers from targeting someone else.

    Kurt’s key takeaways

    Overpayment scams prey on trust and urgency. They can pop up in online sales, job offers, rental agreements and even friendly community boards. By knowing the warning signs, you can stop scammers before they reach your wallet. Stay cautious whenever you’re asked to deposit more than expected and forward the extra. If it sounds strange, it’s probably a scam.

    What should be done to stop overpayment scams now that they’ve gotten out of hand? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com. All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Neon, the No. 2 social app on the Apple App Store, pays users to record their phone calls and sells data to AI firms | TechCrunch

    [ad_1]

    A new app offering to record your phone calls and pay you for the audio so it can sell the data to AI companies is, unbelievably, the No. 2 app in Apple’s U.S. App Store’s Social Networking section.

    The app, Neon Mobile, pitches itself as a money-making tool offering “hundreds or even thousands of dollars per year” for access to your audio conversations.

    Neon’s website says the company pays 30¢ per minute when you call other Neon users and up to $30 per day maximum for making calls to anyone else. The app also pays for referrals. The app first ranked No. 476 in the Social Networking category of the U.S. App Store on September 18, but jumped to No. 10 at the end of yesterday, according to data from app intelligence firm Appfigures.

    On Wednesday, Neon was spotted in the No. 2 position on the iPhone’s top free charts for social apps.

    Neon also became the No. 7 top overall app or game earlier on Wednesday morning, and became the No. 6 top app.

    According to Neon’s terms of service, the company’s mobile app can capture users’ inbound and outbound phone calls. However, Neon’s marketing claims to only record your side of the call unless it’s with another Neon user.

    That data is being sold to “AI companies,” the company’s terms of service state, “for the purpose of developing, training, testing, and improving machine learning models, artificial intelligence tools and systems, and related technologies.”

    Image Credits:Neon Mobile

    The fact that such an app exists and is permitted on the app stores is an indication of how far AI has encroached into users’ lives and areas once thought of as private. Its high ranking within the Apple App Store, meanwhile, is proof that there is now some subsection of the market seemingly willing to exchange their privacy for pennies, regardless of the larger cost to themselves or society.

    Despite what Neon’s privacy policy says, its terms include a very broad license to its user data, where Neon grants itself a:

    “…worldwide, exclusive, irrevocable, transferable, royalty-free, fully paid right and license (with the right to sublicense through multiple tiers) to sell, use, host, store, transfer, publicly display, publicly perform (including by means of a digital audio transmission), communicate to the public, reproduce, modify for the purpose of formatting for display, create derivative works as authorized in these Terms, and distribute your Recordings, in whole or in part, in any media formats and through any media channels, in each instance whether now known or hereafter developed.”

    That leaves plenty of wiggle room for Neon to do more with users’ data than it claims.

    The terms also include an extensive section on beta features, which have no warranty and may have all sorts of issues and bugs.

    a screenshot from Neon's privacy policy, which reads: "Recordings Generally. Certain features of the Service may permit users to send, submit, upload, or otherwise authorize the capture of ("Submit" Recordings and other information to the Service. You retain any copyright and other proprietary rights that you may hold in the Recordings that you Submit to the Service, subject to these Terms including Neon Mobile's rights and licenses granted to Neon Mobile under these Terms. For avoidance of doubt, your rights in Recordings are limited to playback and viewing of your own Recordings through our mobile application, which features we may offer in our sole discretion. 2. License Grant to Neon Mobile. By Submitting Recordings or other information to the Service, you grant Neon Mobile a worldwide, exclusive, irrevocable, transferable royalty-free, fully paid right and license (with the right to sublicense through multiple tiers) to sell, use, host, store, transfer, publicly display, publicly perform (including by means of a digital audio transmission), communicate to the public, reproduce, modify for the purpose of formatting for display, create derivative works as authorized in these Terms, and distribute your Recordings, in whole or in part, in any media formats and through any media channels, in each instance whether now known or hereafter developed."

    Though Neon’s app raises many red flags, it may be technically legal.

    “Recording only one side of the phone call is aimed at avoiding wiretap laws,” Jennifer Daniels, a partner at the law firm Blank Rome’s Privacy, Security & Data Protection Group, tells TechCrunch.

    “Under [the] laws of many states, you have to have consent from both parties to a conversation in order to record it… It’s an interesting approach,” says Daniels.

    Peter Jackson, cybersecurity and privacy attorney at Greenberg Glusker, agreed — and tells TechCrunch that the language around “one-sided transcripts” sounds like it could be a backdoor way of saying that Neon records users’ calls in their entirety, but may just remove what the other party said from the final transcript.

    In addition, the legal experts pointed to concerns about how anonymized the data may really be.

    Neon claims it removes users’ names, emails, and phone numbers before selling data to AI companies. But the company doesn’t say how AI partners or others it sells to could use that data. Voice data could be used to make fake calls that sound like they’re coming from you, or AI companies could use your voice to make their own AI voices.

    “Once your voice is over there, it can be used for fraud,” says Jackson. “Now, this company has your phone number and essentially enough information — they have recordings of your voice, which could be used to create an impersonation of you and do all sorts of fraud.”

    Even if the company itself is trustworthy, Neon doesn’t disclose who its trusted partners are or what those entities are allowed to do with users’ data further down the road. Neon is also subject to potential data breaches, as any company with valuable data may be.

    Neon mobile website screenshot showing founder "Alex"
    Image Credits:Neon Mobile

    In a brief test by TechCrunch, Neon did not offer any indication that it was recording the user’s call, nor did it warn the call recipient. The app worked like any other voice-over-IP app, and the Caller ID displayed the inbound phone number, as usual. (We’ll leave it to security researchers to attempt to verify the app’s other claims.)

    Neon founder Alex Kiam didn’t return a request for comment.

    Kiam, who is identified only as “Alex” on the company website, operates Neon from a New York apartment, a business filing shows.

    A LinkedIn post indicates Kiam raised money from Upfront Ventures a few months ago for his startup, but the investor didn’t respond to an inquiry from TechCrunch as of the time of writing.

    Has AI desensitized users to privacy concerns?

    There was a time when companies looking to profit from data collection through mobile apps handled this type of thing on the sly.

    When it was revealed in 2019 that Facebook was paying teens to install an app that spies on them, it was a scandal. The following year, headlines buzzed again when it was discovered that app store analytics providers operated dozens of seemingly innocuous apps to collect usage data about the mobile app ecosystem. There are regular warnings to be wary of VPN apps, which often aren’t as private as they claim. There are even government reports detailing how agencies regularly purchase personal data that’s “commercially available” on the market.

    Now, AI agents regularly join meetings to take notes, and always-on AI devices are on the market. But at least in those cases, everyone is consenting to a recording, Daniels tells TechCrunch.

    In light of this widespread usage and sale of personal data, there are likely now those cynical enough to think that if their data is being sold anyway, they may as well profit from it.

    Unfortunately, they may be sharing more information than they realize and putting others’ privacy at risk when they do.

    “There is a tremendous desire on the part of, certainly, knowledge workers — and frankly, everybody — to make it as easy as possible to do your job,” says Jackson. “And some of these productivity tools do that at the expense of, obviously, your privacy, but also, increasingly, the privacy of those with whom you are interacting on a day-to-day basis.”

    [ad_2]

    Sarah Perez

    Source link

  • How retirees can stop fake debt collector scams

    [ad_1]

    NEWYou can now listen to Fox News articles!

    You pick up the phone and hear a stern voice claiming you owe money. Maybe it’s for a credit card you don’t recognize, a loan you never took out or some old bill you thought was long gone. Panic sets in, especially if the caller threatens arrest, wage garnishment or lawsuits.

    Unfortunately, this scenario is becoming all too common. Scammers are posing as debt collectors, and retirees are among their favorite targets. Even legitimate debt collection companies have crossed the line. One such company was ordered to pay over $8 million for harassing people into paying fake debts.

    The good news? With a little knowledge and some practical steps, you can spot these calls, protect yourself and stop them before they get too close for comfort.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    JURY DUTY PHONE SCAMS ON THE RISE AS FRAUDSTERS IMPERSONATE LOCAL OFFICIALS, THREATEN ARREST

    A 96-year-old woman sits in an armchair in her apartment in Germany on Sept. 1, 2025, and makes a phone call.  (Matthias Balk/picture alliance via Getty Images)

    Why retirees are prime targets

    Scammers don’t call at random. Retirees often make ideal marks because:

    • Less frequent monitoring: Many retirees check credit reports and bank accounts less often, making it easier for fraud to go unnoticed.
    • Accumulated assets: Retirement savings, pensions and home equity make seniors look “cash-rich” to scammers.
    • Trust factor: Politeness and trust on the phone can be exploited.
    • Less tech-savvy: Some retirees feel less comfortable with online verification.

    This combination creates a perfect storm for fake debt collection scams.

    Red flags of fake debt collector calls

    Recognizing the signs can stop scammers in their tracks.

    • Immediate threats or pressure: Real collectors cannot threaten arrest or use abusive language under the Fair Debt Collection Practices Act (FDCPA).
    • Unusual payment methods: Gift cards, wire transfers and cryptocurrency are red flags. Legitimate collectors use checks, debit or bank payments.
    • Refusal to verify debt: If they won’t send written proof, hang up.
    • Mismatch with public records: Fake companies often use official-sounding names that don’t exist.

    Requests for unrelated personal information: Collectors don’t need your Social Security number or bank logins.

    FAKE AGENT PHONE SCAMS ARE SPREADING FAST ACROSS THE US

    An elderly person hanging up a phone

    Kurt “Cyberguy” Knutsson lays out red flags of fake debt collector calls. (Matthias Balk/picture alliance via Getty Images)

    How to safely verify debt collector calls

    Even if a call raises red flags, it’s essential to verify the information before taking action. Here’s how:

    1) Request written verification

    Under the FDCPA, you have the right to ask for a debt validation letter. This document should include:

    • The creditor’s name
    • Original amount owed
    • Verification that the collector is legally authorized to collect the debt.

    Ask for this before paying or sharing any personal info.

    2 Look up the collector

    Check with state attorneys general offices or the Consumer Financial Protection Bureau (CFPB). Verify that the company exists and is licensed to collect in your state.

    3) Contact the original creditor

    If you recognize the debt or think it may be legitimate, call the creditor directly using a verified phone number. Do not rely on the caller’s number; scammers often spoof official-looking numbers.

    4) Use trusted resources

    The FTC offers a “Debt Collection” section on its website with tips and complaint forms. If you suspect fraud, filing a report can help stop the scammers from targeting others.

    CLICK HERE TO GET THE FOX NEWS APP

    A woman on the phone

    Experts warn retirees to be vigilant regarding fake debt collector calls. (Kurt “CyberGuy” Knutsson)

    Pro tip: Extra step to protect your personal information

    Fraudsters rely on personal data to make calls sound convincing. Reducing the amount of information available about you online lowers your risk. Data brokers collect and sell details like your name, phone, address and even past debts. A data removal service can automatically remove your data from hundreds of broker sites, making it harder for scammers to find and target you.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice.  They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    When and where to report a scam

    If you’ve encountered a fake debt collector, report them right away:

    • FTC: File at FTC.gov
    • State Attorney General: Use the consumer complaint division in your state
    • CFPB (Consumer Financial Protection Bureau): Submit a complaint online at consumerfinance.gov/complaint/or by phone

    Reporting helps protect other retirees from falling victim.

    Kurt’s key takeaways

    Protecting your retirement isn’t just about managing your savings; it’s about defending your personal information, too. Scammers thrive on fear, urgency and trust, but you now have the knowledge to push back. By spotting red flags, verifying calls and reducing what’s available about you online, you can stop fake debt collectors in their tracks.

    If a scammer called you tomorrow, would you be ready to spot the lies and protect your hard-earned savings? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Why iPhone users are the new prime scam targets

    [ad_1]

    NEWYou can now listen to Fox News articles!

    New research may shock a lot of Apple fans: iPhone users are actually more likely to fall for online scams than Android owners. The problem isn’t the device itself; it’s the habits of the people using it.

    The survey from Malwarebytes, a global cybersecurity company, of 1,300 adults across the United States, United Kingdom, Austria, Germany and Switzerland, found that many iPhone owners put blind trust in Apple’s security. That confidence makes them easier targets for scammers who count on overconfidence.

    5 PHONE SETTINGS TO CHANGE RIGHT NOW FOR A SAFER SMARTPHONE

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CyberGuy.com/Newsletter

    New research suggests iPhone users are more likely to fall for online scams than Android users. (Kurt “CyberGuy” Knutsson)

    The truth about iPhone security habits

    Here’s what the Malwarebytes survey uncovered:

    • More than half of iPhone users (53%) admitted they’ve fallen for a scam, compared to 48% of Android users.
    • Only 21% of iPhone owners add security software, while 29% of Android users do.
    • Just 35% of iPhone users set unique, strong passwords, compared to 41% of Android owners.
    • 47% of iPhone users grabbed a “best price” deal from shady sellers, compared to 40% of Android users.
    • 41% of iPhone owners DM’d sellers for discounts on social media, compared to 33% of Android owners.

    The takeaway? It’s not the phone that makes you safe, it’s your choices every time you go online.

    An image of an iPhone

    A survey from Malwarebytes found that many iPhone owners blindly trust Apple’s security measures, which makes them easier targets for scammers who count on overconfidence. (Kurt “CyberGuy” Knutsson)

    Why this matters

    For years, Apple’s reputation led iPhone users to believe they were automatically safer. This study proves otherwise. Cybercriminals don’t care what brand of phone you carry; they care about how easy it is to trick you. And right now, too many iPhone users are letting their guard down.

    An image of an iPhone

    Many iPhone software updates contain security patches that block new threats to keep users safe.  (Kurt “CyberGuy” Knutsson)

    7 ways to stay safe on iPhone

    Even if you love your iPhone, staying safe means making smarter choices online. Follow these steps to keep scammers one step behind you.

    1) Stop and double-check

    If something feels off, whether it’s a text, link, or offer, pause. Scammers rely on urgency to trick you.

    2) Avoid random links and shady DMs

    Never click on links or QR codes from unknown senders. Always visit the company’s website directly. Also, use strong antivirus software to block malicious links before they reach you. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com/LockUpYourTech

    3) Keep your software updated

    Apple pushes out updates for a reason. Many contain security patches that block new threats. Make sure your iPhone is always running the latest iOS and app updates.

    How to update iOS:

    • Go to Settings
    • Tap General
    • Click Software Update and install any available updates. 

    Manually updating apps:

    • Open the App Store.
    • Tap your profile icon at the top right.
    • Scroll down to see pending updates.
    • Tap Update All (or update individual apps).

    Enabling Automatic App Updates:

    • Open Settings.
    • Scroll down and tap App Store.
    • Under Automatic Downloads, toggle on App Updates.

    This way, your phone will always stay current, reducing the chances that hackers can exploit old vulnerabilities.

    IS YOUR PHONE HACKED? HOW TO TELL AND WHAT TO DO

    4) Pick stronger, unique passwords

    Using the same password everywhere is a hacker’s dream. Create unique ones for each account. Consider using a password manager, which securely stores and generates complex passwords, reducing the risk of password reuse.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see CyberGuy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2025 at CyberGuy.com/Passwords

    5) Consider using a personal data removal service

    Scammers thrive on the personal details they can easily find about you online, and iPhone users in particular tend to overshare and trust their device to keep them safe. That leaves a bigger trail for criminals to exploit. A personal data removal service helps wipe your information from data broker sites and shady lists that fuel targeted scams. 

    While no service can erase everything, it makes it much harder for crooks to connect the dots and trick you. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: CyberGuy.com/FreeScan

    6) Turn on two-factor authentication (2FA)

    Turning on two-factor authentication (2FA) is one of the most powerful ways to lock down your accounts. It adds an extra login step that blocks criminals, even if they already have your password. On your iPhone:

    • Open the Settings app.
    • Tap on [your name] (your Apple ID at the top).
    • Select Sign‑In & Security.
    • Tap Turn On Two‑Factor Authentication, then tap Continue.
    • Enter a trusted phone number to receive verification codes (via text or call), tap Next, and enter the code sent to you to complete the setup.

    Once set up, you’ll get a code each time you or someone else tries to sign in.

    7) Don’t trade personal info for deals

    Skip giving out your phone number or email just to snag a coupon, unlock a discount code, or enter a giveaway. Scammers use those details to target you later with spam, phishing attempts, and even identity theft schemes. Instead, create and use an alias email address for sign-ups, promotions, or contests. That way your real inbox stays private, and suspicious offers won’t expose your personal data.

    For recommendations on private and secure email providers that offer alias addresses, visit CyberGuy.com/Mail

    CLICK HERE TO GET THE FOX NEWS APP

    What this means for you

    If you own an iPhone, don’t assume Apple’s built-in tools are enough. Android users appear to be more proactive, but everyone is vulnerable. Real security comes from your habits, not your hardware.

    Kurt’s key takeaways

    The bottom line: iPhone users are falling for scams more often because they trust too much and protect too little. The fix is simple: be cautious, be skeptical, and add extra protection. Because when it comes to scams, it’s not about the device, it’s about you.

    Do you still believe Apple makes you safer, or are you ready to admit that scammers can outsmart any phone? Let us know by writing to us at CyberGuy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CyberGuy.com/Newsletter

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • A Dangerous Worm Is Eating Its Way Through Software Packages

    [ad_1]

    New findings this week showed that a misconfigured platform used by the Department of Homeland Security left sensitive national security information—including data related to the surveillance of Americans—exposed and accessible to thousands of people. Meanwhile, 15 New York officials were arrested by Immigration and Customs Enforcement and the New York Police Department this week in or around 26 Federal Plaza—where ICE detains people in what courts have ruled are unsanitary conditions.

    Russia conducted conspicuous military exercises testing hypersonic missiles near NATO borders, stoking tensions in the region after the Kremlin had already recently flown drones into Polish and Romanian airspace. Scammers have a new tool for sending spam texts, known as “SMS blasters,” that can send up to 100,000 texts per hour while evading telecom company anti-spam measures. Scammers deploy rogue cell towers that trick people’s phones into connecting to the malicious devices so they can send the texts directly and bypass filters. And a pair of flaws in Microsoft’s Entra ID identity and access management system, which have been patched, could have been exploited to access virtually all Azure customer accounts—a potentially catastrophic disaster.

    WIRED published a detailed guide this week to acquiring and using a burner phone, as well as alternatives that are more private than a regular phone but not as labor-intensive as a true burner. And we updated our guide to the best VPNs

    But wait, there’s more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    The cybersecurity world has seen, to its growing dismay, plenty of software supply-chain attacks, in which hackers hide their code in a legitimate piece of software so that it’s silently seeded out to every system that uses that code around the world. In recent years, hackers have even tried linking one software supply-chain attack to another, finding a second software developer target among their victims to compromise yet another piece of software and launch a new round of infections. This week saw a new and troubling evolution of those tactics: a full-blown self-replicating supply-chain attack worm.

    The malware, which has been dubbed Shai-Hulud after the Fremen name for the monstrous Sandworms in the sci-fi novel Dune (and the name of the Github page where the malware published stolen credentials of its victims), has compromised hundreds of open source software packages on the code repository Node Packet Management, or NPM, used by developers of Javascript. The Shai-Hulud worm is designed to infect a system that uses one of those software packages, then hunt for more NPM credentials on that system so that it can corrupt another software package and continue its spread.

    By one count, the worm has spread to more than 180 software packages, including 25 used by the cybersecurity firm CrowdStrike, though CrowdStrike has since had them removed from the NPM repository. Another count from cybersecurity firm ReversingLabs put the count far higher, at more than 700 affected code packages. That makes Shai-Hulud one of the biggest supply-chain attacks in history, though the intent of its mass credential-stealing remains far from clear.

    Western privacy advocates have long pointed to China’s surveillance systems as the potential dystopia awaiting countries like the United States if tech industry and government data collection goes unchecked. But a sprawling Associated Press investigation highlights how China’s surveillance systems have reportedly been largely built on US technologies. The AP’s reporters found evidence that China’s surveillance network—from the “Golden Shield” policing system that Beijing officials have used to censor the internet and crack down on alleged terrorists to the tools used to target, track, and often detain Uyghurs and the country’s Xinjiang region—appear to have been built with the help of American companies, including IBM, Dell, Cisco, Intel, Nvidia, Oracle, Microsoft, Thermo Fisher, Motorola, Amazon Web Services, Western Digital, and HP. In many cases, the AP found Chinese-language marketing materials in which the Western companies specifically offer surveillance applications and tools to Chinese police and domestic intelligence services.

    Scattered Spider, a rare hacking and extortion cybercriminal gang based largely in Western countries, has for years unleashed a trail of chaos across the internet, hitting targets from MGM Resorts and Caesar’s Palace to the Marks & Spencer grocery chain in the United Kingdom. Now two alleged members of that notorious group have been arrested in the UK: 19-year-old Thalha Jubair and 18-year-old Owen Flowers, both charged with hacking the Transport for London transit system—reportedly inflicting more than $50 million in damage—among many other targets. Jubair alone is accused of intrusions targeting 47 organizations. The arrests are just the latest in a string of busts targeting Scattered Spider, which has nonetheless continued a nearly uninterrupted string of breaches. Noah Urban, who was convicted on charges related to Scattered Spider activity, spoke from jail to Bloomberg Businessweek for a long profile of his cybercriminal career. Urban, 21, has been sentenced to a decade in prison.

    [ad_2]

    Lily Hay Newman, Andy Greenberg

    Source link

  • Sam’s Club customers targeted by phishing scam using fake $100 reward offers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Dennis and Carole recently reached out to us with a warning about a suspicious email claiming to offer a $100 Sam’s Club reward. 

    “We received this yesterday, and my wife fell for the scam and initiated the free gift offer. No credit card other than email transferred,” Dennis said.

    The email looked professional, with the official Sam’s Club logo at the top. It read, “YOUR OPINION IS IMPORTANT. Exclusive. YOU CAN GET A $100 REWARD.” It then invited the recipient to “Take a short survey to claim your $100 reward. Click the button below to get started,” with a bold black button labeled “GET STARTED NOW!”

    Despite no credit card being entered, the couple wanted to know:

    • Will scammers be able to charge their credit card?
    • Do they already have credit card info?
    • What steps should they take?

    Let’s break this all down.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    THE TRUTH BEHIND THOSE MYSTERIOUS SHIPMENT EMAILS IN YOUR INBOX

    A couple warns about a new email scam disguised as a Sam’s Club survey. (Kurt “CyberGuy” Knutsson)

    Why this Sam’s Club email is a scam

    At first glance, the email looked like it came straight from Sam’s Club, complete with the logo, blue color scheme and a tempting promise of a $100 reward for filling out a short survey. That’s exactly what scammers want you to think.

    This is a classic phishing scam. Cybercriminals copy a trusted brand’s style to trick you into clicking their links or entering personal information. Once you engage, they can:

    • Collect your email address for spam lists
    • Send more realistic-looking phishing attempts
    • Try to lure you into giving up payment or account details in future messages
    • Direct you to malware-infected websites

    In this case, only an email address was entered. That means there’s no direct credit card risk, yet. However, scammers now know the address is active and that someone at it will click through, making it more valuable for targeted scams later. The next step is protecting yourself quickly, because stopping them now is far easier than dealing with identity theft later.

    DON’T FALL FOR THIS BANK PHISHING SCAM TRICK

    person receiving spam email on laptop

    Experts warn consumers not to click suspicious looking links. (Peter Dazeley)

    How to protect yourself after clicking a link in a scam email

    If you entered your email in a scam form, take these steps right away to reduce the risk of further attacks:

    1) Use strong antivirus software

    Run a scan with a trusted antivirus program. Many modern security tools also include phishing protection, blocking dangerous links before they can load. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at CyberGuy.com.

    2) Mark the email as phishing

    Use your email provider’s spam or phishing report tool to flag the message. This helps block future attempts and trains filters to catch similar scams. 

    3) Consider a data removal service

    Data removal services can contact data brokers to remove your personal information from their lists. This makes it harder for scammers to target you with more personalized attacks. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice.  They aren’t cheap — and neither is your privacy.  These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.  It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet.  By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Sam's Club Store Bentonville Arkansas

    Scammers are claiming to offer a $100 Sam’s Club reward. (REUTERS/Rick Wilking)

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    4) Watch for follow-up scams

    Scammers often follow up with urgent-sounding emails to “confirm” your account or claim you won a prize. Delete these immediately without clicking links or opening attachments. 

    5) Change your passwords and strengthen security

    Never reuse the same password across multiple accounts. If scammers target your email address, they may try it with common password guesses. Create unique, strong passwords for each account and store them in a reputable password manager.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

    6) Report the scam

    Forward the email to:

    • Sam’s Club: phishing@samsclub.com
    • FTC: reportphishing@apwg.org

    Reporting helps both the brand and law enforcement track scam activity.

    CLICK HERE TO GET THE FOX NEWS APP

    Consumers are advised to report phishing emails to the company or the FTC.

    Consumers are advised to report phishing emails to the company or the FTC. (CyberGuy.com)

    Kurt’s key takeaways

    Even if you avoid entering payment details, your personal information still has value to scammers. An email address can open the door to phishing attacks designed to steal passwords, install malware, or gather more sensitive data. Scammers know how to make an email look convincing, especially when they dangle a gift card as bait. By staying alert, reporting suspicious emails and protecting your personal data, you can reduce your risk.

    Have you ever received a fake reward email from a brand you trust? How did you handle it? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Here’s the tech powering ICE’s deportation crackdown  | TechCrunch

    [ad_1]

    President Donald Trump made countering immigration one of his flagship issues during last year’s presidential campaign, promising an unprecedented number of deportations. 

    In his first eight months in office, that promise turned into around 350,000 deportations, a figure that includes deportations by Immigration and Customs Enforcement, or ICE (around 200,000), Customs and Border Protection (more than 132,000), and almost 18,000 self-deportations, according to CNN.  

    ICE has taken center stage in Trump’s mass deportation campaign, raiding homes, workplaces, and public parks in search of undocumented immigrants. To aid its efforts, ICE has at its disposal several technologies capable of identifying and surveilling individuals and communities.

    Here is a recap of some of the technology that ICE has in its digital arsenal. 

    Clearview AI facial recognition

    Clearview AI is perhaps the most well-known facial-recognition company today. For years, the company promised to be able to identify any face by searching through a large database of photos it had scraped from the internet. 

    On Monday, 404 Media reported that ICE has signed a contract with the company to support its law enforcement arm Homeland Security Investigations (HSI), “with capabilities of identifying victims and offenders in child sexual exploitation cases and assaults against law enforcement officers.” 

    According to a government procurement database, the contract signed last week is worth $3.75 million. 

    ICE has had other contracts with Clearview AI in the last couple of years. In September 2024, the agency purchased “forensic software” from the company, a deal worth $1.1 million. The year before, ICE paid Clearview AI nearly $800,000 for “facial recognition enterprise licenses.”

    Clearview AI did not respond to a request for comment. 

    Paragon phone spyware

    Contact Us

    Do you have more information about ICE and the technology it uses? We would love to learn how this affects you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

    In September 2024, ICE signed a contract worth $2 million with Israeli spyware maker Paragon Solutions. Almost immediately, the Biden administration issued a “stop work order,” putting the contract under review to make sure it complied with an executive order on the government’s use of commercial spyware. 

    Because of that order, for nearly a year, the contract remained in limbo. Then, last week, the Trump administration lifted the stop work order, effectively reactivating the contract. 

    At this point, the status of Paragon’s relationship with ICE in practice is unclear.  

    The records entry from last week said that the contract with Paragon is for “a fully configured proprietary solution including license, hardware, warranty, maintenance, and training.” Practically speaking, unless the hardware installation and training were done last year, it may take some time for ICE to have Paragon’s system up and running.

    It’s also unclear if the spyware will be used by ICE or HSI, an agency whose investigations are not limited to immigration, but also cover online child sexual exploitation, human trafficking, financial fraud, and more.

    Paragon has long tried to portray itself as an “ethical” and responsible spyware maker, and now has to decide if it’s ethical to work with Trump’s ICE. A lot has happened to Paragon in the last year. In December, American private equity giant AE Industrial purchased Paragon, with a plan to merge it with cybersecurity company RedLattice, according to Israeli tech news site Calcalist.

    In a sign that the merger may have taken place, when TechCrunch reached out to Paragon for comment on the reactivation of the ICE contract last week, we were referred to RedLattice’s new vice president of marketing and communications Jennifer Iras. 

    RedLattice’s Iras did not respond to a request for comment for this article, nor for last week’s article.

    In the last few months, Paragon has been ensnared in a spyware scandal in Italy, where the government has been accused of spying on journalists and immigration activists. In response, Paragon cut ties with Italy’s intelligence agencies. 

    Phone hacking and unlocking technology

    In mid-September, ICE’s law enforcement arm Homeland Security Investigations signed a contract with Magnet Forensics for $3 million.

    This contract is specifically for software licenses so that Homeland Security Investigations agents can “recover digital evidence, process multiple devices” and “generate forensic reports,” according to the contract description.

    Magnet is the current maker of the phone hacking and unlocking devices known as Graykey. These devices essentially give law enforcement agents the ability to connect a locked phone to them, and be able to unlock it and access the data inside of them. 

    Magnet Forensics, which merged with Graykey makers Grayshift in 2023, did not respond to a request for comment.

    For years, ICE has used the legal research and public records data broker LexisNexis to support its investigations. 

    In 2022, two non-profits obtained documents via Freedom of Information Act requests, which revealed that ICE performed more than 1.2 million searches over seven months using a tool called Accurint Virtual Crime Center. ICE used the tool to check the background information of migrants.   

    A year later, The Intercept revealed that ICE was using LexisNexis to detect suspicious activity and investigate migrants before they even committed a crime, a program that a critic said enabled “mass surveillance.”

    According to public records, LexisNexis currently provides ICE “with a law enforcement investigative database subscription (LEIDS) which allows access to public records and commercial data to support criminal investigations.” 

    This year, ICE has paid $4.7 million to subscribe to the service. 

    LexisNexis spokesperson Jennifer Richman told TechCrunch that ICE has used the company’s product “data and analytics solutions for decades, across several administrations.”

    “Our commitment is to support the responsible and ethical use of data, in full compliance with laws and regulations, and for the protection of all residents of the United States,” said Richman, who added that LexisNexis “partners with more than 7,500 federal, state, local, tribal, and territorial agencies across the United States to advance public safety and security.” 

    Surveillance giant Palantir

    Data analytics and surveillance technology giant Palantir has signed several contracts with ICE in the last year. The biggest contract, worth $18.5 million from September 2024, is for a database system called “Investigative Case Management,” or ICM.

    The contract for ICM goes back to 2022, when Palantir signed a $95.9 million deal with ICE. The Peter Thiel-founded company’s relationship with ICE dates back to the early 2010s. 

    Earlier this year, 404 Media, which has reported extensively on the technology powering Trump’s deportation efforts, and particularly Palantir’s relationship with ICE, revealed details of how the ICM database works. The tech news site reported that it saw a recent version of the database, which allows ICE to filter people based on their immigration status, physical characteristics, criminal affiliation, location data, and more. 

    According to 404 Media, “a source familiar with the database” said it is made up of ‘tables upon tables’ of data and that it can build reports that show, for example, people who are on a specific type of visa who came into the country at a specific port of entry, who came from a specific country, and who have a specific hair color (or any number of hundreds of data points).” 

    The tool, and Palantir’s relationship with ICE, was controversial enough that sources within the company leaked to 404 Media an internal wiki where Palantir justifies working with Trump’s ICE. 

    Palantir is also developing a tool called “ImmigrationOS,” according to a contract worth $30 million revealed by Business Insider. 

    ImmigrationOS is said to be designed to streamline the “selection and apprehension operations of illegal aliens,” give “near real-time visibility” into self-deportations, and track people overstaying their visa, according to a document first reported on by Wired.

    First published on September 13, and updated on September 18 to include Magnet Forensics’ new contract.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • Your discarded luggage tags are worth money to scammers

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Bad actors can use almost anything to scam you. You’ve already heard about them using personal information such as phone numbers, email addresses and government IDs to commit identity theft. But they don’t stop there. There have been reports of hackers using your home’s location on maps to blackmail you or impersonating your boss to demand money.

    These are still very believable tactics, but did you know that even the luggage tags you barely notice can be misused? That’s correct. Well, now bad actors are targeting luggage tags to file for reimbursement.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    AIRLINES SECRETLY SOLD US TRAVELERS’ DATA TO HOMELAND SECURITY

    Luggage tag scam explained and how to avoid it

    An alleged baggage claims manager at Delta Air Lines has warned travelers about a growing scam that uses discarded luggage tags to commit fraud.

    In a Reddit post that has since drawn thousands of comments, the worker claimed scammers are watching passengers remove their tags at baggage claim and retrieving them to submit fake claims for lost luggage. The tags often contain enough personal and travel information to file for reimbursement.

    A baggage claim manager alleges that scammers are stealing travelers’ information from old bag tags. (iStock)

    “There’s been an influx of fraudulent claims using tossed luggage tags,” the worker wrote. “It’s creating issues for people with legitimate claims.”

    The post advises waiting until you are away from the airport before removing tags from checked bags and avoiding leaving them in hotel trash cans. Former hotel staff commenting on the post said they had seen similar fraud schemes involving tags found in guest rooms.

    Travelers responding to the warning also noted that printed boarding passes can be exploited in the same way, and shared examples of airports, such as in Japan, that provide secure disposal bins for tags.

    FBI WARNS OF QR CODE SCAM DISGUISED IN MYSTERY PACKAGES

    An airport attendant attaches a label on a suitcase at an airline check-in desk.

    An airport attendant attaches a label on a suitcase at an airline check-in desk. (iStock)

    How serious is the luggage tag scam threat?

    The luggage tag scam is a documented and growing problem in 2025, with airport workers, especially baggage claims staff at major airlines, reporting a surge in fraudulent lost luggage claims tied to discarded tags.

    Multiple firsthand accounts confirm that processing legitimate compensation is being complicated by false claims using details found on bag tags. However, travel security experts and industry observers note that, while cases are increasing, the scam may not be extremely widespread or high-volume at this time.

    Most tags only contain limited information, such as name, flight number and baggage IDs, and airlines’ tracking systems can sometimes detect if a claim is fake by reviewing baggage scan logs and RFID tagging. There are also no official warnings or statistics from major airlines, government authorities or law enforcement indicating this technique has reached epidemic levels or led to confirmed prosecutions.

    CLICK HERE TO GET THE FOX NEWS APP

    Newark Liberty International Airport baggage claim

    Stay safe with luggage locks, door locks and anti-theft bags. (REUTERS/Vincent Alban)

    7 ways to stay safe from the luggage tag scam

    The luggage tag scam might not sound like the most dangerous travel threat, but ignoring it can still leave you exposed to fraud. Here are simple, effective steps to protect yourself. 

    1) Remove tags only after leaving the airport

    Wait until you’re at home, in your car or in another private location before taking tags off your checked bags. This prevents scammers from grabbing them in public areas. 

    2) Shred or destroy old tags

    Never toss tags in the trash intact. Tear them up or cut through barcodes and printed details so they can’t be reused for fake claims.

    3) Avoid leaving tags in hotel rooms

    Dispose of tags yourself instead of leaving them in a hotel wastebasket. Cleaning staff or other guests could find and misuse them. 

    4) Secure boarding passes too

    Treat printed boarding passes the same way as luggage tags. Keep them until you can destroy them securely. 

    5) Be alert in baggage claim areas

    Watch for anyone loitering near the carousel and observing passengers closely. Stay aware of your surroundings while handling travel documents. 

    6) Use digital boarding passes when possible

    Opt for mobile boarding passes instead of printed ones. This removes the risk of discarded paper passes falling into the wrong hands.

    7) Limit personal details on luggage tags

    Avoid printing your full home address or primary phone number. Instead, use your name, a travel-only email and either a P.O. box or work address. You can even create a simple alias email just for travel, which forwards to your main inbox but keeps your real address private. This way, airlines and honest finders can still reach you without exposing sensitive personal details to scammers.

    For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com.

    8) Track Your Bags with AirTags

    Another way to protect yourself is by putting a small tracker inside your luggage, such as an Apple AirTag or a similar Bluetooth tracker. These devices connect to your phone and let you see where your bag is in near real-time. If your suitcase goes missing or ends up in the wrong place, you’ll know faster than waiting for the airline to track it down.

    Place the tracker inside your bag rather than on the handle so it can’t be easily removed. Check its location through your phone before leaving the airport, and keep an eye on it during layovers. While AirTags can’t prevent someone from misusing an old luggage tag, they give you proof of where your bag actually is if you ever need to dispute a lost luggage claim or theft. 

    Kurt’s key takeaway

    While the luggage tag scam may not be widespread yet, it exploits a simple oversight that most travelers rarely consider. Until airlines and airports put better safeguards in place, the burden falls on passengers to protect their own information. That means treating something as ordinary as a bag tag like sensitive data.

    What do you do with your luggage tags after your trip? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Stop Medicare scams before they stop you

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Medicare is a tempting prize for scammers. Because it’s a public program funded by taxpayers, it has a huge budget to distribute and that’s what attracts scammers. In 2024, improper payments added up to $54 billion. Some scams involve setting up fake companies to file bogus claims, while others target beneficiaries directly, stealing their personal information and denying them their right to treatment.

    If you fall victim to such a scam, the consequences can range from small financial losses to actual health risks. Scammers may trick you into paying fake fees, premiums or “copays” over the phone or online. They may also go after your personal information or Medicare number to bill for services or equipment you never requested, which could leave you with less coverage when you actually need treatment.

    It’s better to know what you’re up against so you don’t accidentally lose your Medicare benefits.

    FBI WARNS SENIORS ABOUT BILLION-DOLLAR SCAM DRAINING RETIREMENT FUNDS, EXPERT SAYS AI DRIVING IT

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CyberGuy.com newsletter 

    A patient is examined on Dec. 5, 2022, at the Indiana University Health Cancer Center. (Kelly Wilkinson/USA Today Network via Imagn Images)

    What to look out for to recognize a Medicare scam

    Scammers are getting more and more professional these days. With Medicare scams, fraudsters may use spoofed phone numbers, emails and websites to make their schemes seem more believable. Luckily, there are still some telltale signs to look out for.

    Regardless of the communication method, phone, email, mail or in person, scammers will try to:

    • Create fear or urgency
    • Pressure you to act quickly
    • Threaten you with consequences
    A woman with painted nails types on a MacBook.

    Scam artists often try to create time pressure in order to compel their victims to act quickly, before they have time to think. (Kurt “CyberGuy” Knutsson)

    Scammers calling you in Medicare’s name to demand payments

    Some scammers use spoofed phone numbers to impersonate Medicare representatives. They may try to trick you into paying fake fees or buying unnecessary products.

    These often include:

    • Fake health insurance upgrades
    • “Low-cost” medical equipment
    • Fake tests or genetic kits
    • Discounted medication

    Remember: Medicare will never call you unless you ask them to, and they will never ask for money.

    If you ever owe Medicare fees, you will be contacted by mail, not by phone.

    Medicare will never charge random “activation” or “renewal” fees, those are always scams. However, Medicare itself is not completely free. Part A (hospital coverage) is free for most people, but Part B (doctor visits, outpatient care, preventive services) always requires a monthly premium, and you may also pay deductibles or copays for certain services.

    Scammers try to mimic these legitimate bills to steal your money. If you’re asked for payment over the phone or online, that’s your red flag it’s a scam.

    Scammers try to mimic these payments to steal your money

    Scammers may try calling you in Medicare’s name to ask for your Medicare number or card details.

    Money isn’t the only thing scammers are after; your Medicare number can be just as valuable, if not more so.

    This scam follows a similar scheme: fraudsters call you pretending to be Medicare employees and ask you to provide your Medicare number for fake reasons, such as:

    • Upgrading your plan
    • Updating your account details
    • Offering “free” drugs
    • Issuing a new Medicare card
    • … and more

    Let me be clear: Medicare will never call you, whether it’s about paying fees, updating your account or anything else.

    Scammers want your Medicare information so they can impersonate you and obtain medical supplies, prescription drugs or treatments in your name.

    REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS

    Scammers calling you in Medicare’s name to extort your personal data

    Your Social Security number (SSN) can be the final piece scammers need to impersonate you. During these calls, fraudsters may ask not only for your Medicare details but also for other personal information, such as your SSN, date of birth or similar data.

    They often use the same excuses as when trying to obtain Medicare information, such as:

    • Upgrading your plan
    • Issuing new cards
    • Other account-related reasons.

    Let me emphasize this again: Medicare will never call you for these reasons.

    Even if the phone number looks legitimate and the caller sounds professional, the moment you’re asked for personal details or payments, you know it’s a scam.

    What to do if you suspect a Medicare scam

    If it’s a phone call, just hang up.

    You don’t need to explain yourself or engage in a conversation with scammers. If they threaten you with consequences, do not believe them; scammers use fear to pressure you into making poor decisions.

    Remember: If Medicare or its service providers had important information to communicate, they would do so by mail, not by phone.

    Apart from not letting scammers take advantage of you, you can also help others by:

    • Reporting the fraud to Medicare at 1‑800‑MEDICARE (1‑800‑633‑4227)
    • Reporting the fraud to the US Department of Health and Human Services at oig.hhs.gov/fraud/report-fraud/
    • Reporting the fraud to the Federal Trade Commission (FTC) at reportfraud.ftc.gov/
    A woman types on her laptop at a kitchen table.

    A woman checks her Medicare account on her laptop. (Kurt “CyberGuy” Knutsson)

    How to make yourself less of a target of Medicare scams

    You don’t have to sit tight and hope that scammers won’t target you. Instead, you can take some active measures to make such attempts less likely.

    1) Lower your online exposure

    To target you, scammers first need to gather some basic information about you, like your phone number. That information and much more can be easily looked up on people search sites, platforms operated by data brokers that let people search for others. The good news is that you can opt out of these platforms. You can do it manually by visiting each website and filling out the opt-out forms or you can automate the process.

    2) Use a data removal service to help you

    Data removal services work on your behalf to erase personal details like your phone number, address and email from people-search sites and data broker databases. By reducing the amount of information available online, these services make it harder for scammers to find and target you. Many of them also monitor whether your data reappears, so you stay protected over time without having to constantly check dozens of sites yourself.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to come after you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

    Get a free scan to find out if your personal information is already out on the web: CyberGuy.com.

    3) Monitor your Medicare statements regularly

    Always review your Medicare Summary Notices (MSNs) or Explanation of Benefits (EOBs). These statements show what services have been billed in your name. If you see charges for services, equipment or prescriptions you never received, report it right away. Quick action can stop fraud before it impacts your care.

    4) Use identity theft protection services

    Identity theft protection tools can alert you if your Social Security number, Medicare number or other sensitive details show up on the dark web or are used to open new accounts. These services can also guide you through recovery if scammers misuse your information.

    See my tips and best picks on how to protect yourself from identity theft at CyberGuy.com.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaways

    Medicare scams are designed to exploit fear, urgency and confusion. By recognizing the warning signs and knowing what Medicare will and will not do, you can stay one step ahead of fraudsters. Protecting your personal information and reducing your online exposure are key to keeping your coverage safe. With a few smart habits, you can make yourself a less appealing target and help others by reporting scams when you see them.

    Have you or someone you know ever been targeted by a Medicare scam, and how did you handle it? Let us know by writing to us at CyberGuy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CyberGuy.com newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • OpenAI’s Teen Safety Features Will Walk a Thin Line

    [ad_1]

    OpenAI announced new teen safety features for ChatGPT on Tuesday as part of an ongoing effort to respond to concerns about how minors engage with chatbots. The company is building an age-prediction system that identifies if a user is under 18 years old and routes them to an “age-appropriate” system that blocks graphic sexual content. If the system detects that the user is considering suicide or self-harm, it will contact the user’s parents. In cases of imminent danger, if a user’s parents are unreachable, the system may contact the authorities.

    In a blog post about the announcement, CEO Sam Altman wrote that the company is attempting to balance freedom, privacy, and teen safety.

    “We realize that these principles are in conflict, and not everyone will agree with how we are resolving that conflict,” Altman wrote. “These are difficult decisions, but after talking with experts, this is what we think is best and want to be transparent in our intentions.”

    While OpenAI tends to prioritize privacy and freedom for adult users, for teens the company says it puts safety first. By the end of September, the company will roll out parental controls so that parents can link their child’s account to their own, allowing them to manage the conversations and disable features. Parents can also receive notifications when “the system detects their teen is in a moment of acute distress,” according to the company’s blog post, and set limits on the times of day their children can use ChatGPT.

    The moves come as deeply troubling headlines continue to surface about people dying by suicide or committing violence against family members after engaging in lengthy conversations with AI chatbots. Lawmakers have taken notice, and both Meta and OpenAI are under scrutiny. Earlier this month, the Federal Trade Commission asked Meta, OpenAI, Google, and other AI firms to hand over information about how their technologies impact kids, according to Bloomberg.

    At the same time, OpenAI is still under a court order mandating that it preserve consumer chats indefinitely—a fact that the company is extremely unhappy about, according to sources I’ve spoken to. Today’s news is both an important step toward protecting minors and a savvy PR move to reinforce the idea that conversations with chatbots are so personal that consumer privacy should only be breached in the most extreme circumstances.

    “A Sexbot Avatar in ChatGPT”

    From the sources I’ve spoken to at OpenAI, the burden of protecting users weighs heavily on many researchers. They want to create a user experience that is fun and engaging, but it can quickly veer into becoming disastrously sycophantic. It’s positive that companies like OpenAI are taking steps to protect minors. At the same time, in the absence of federal regulation, there’s still nothing forcing these firms to do the right thing.

    In a recent interview, Tucker Carlson pushed Altman to answer exactly who is making these decisions that impact the rest of us. The OpenAI chief pointed to the model behavior team, which is responsible for tuning the model for certain attributes. “The person I think you should hold accountable for those calls is me,” Altman added. “Like, I’m a public face. Eventually, like, I’m the one that can overrule one of those decisions or our board.”

    [ad_2]

    Kylie Robison

    Source link

  • I Tried Breaking the Best VPNs. Here Are the 5 That Survived

    [ad_1]

    Other VPNs We’ve Tested

    Private Internet Access (PIA) has a long history in the VPN space, and it’s maintained a track record of defending user privacy—even in the face of actual criminal activity. In 2016, a criminal complaint was filed in Florida against Preston Alexander McWaters for threats made online. McWaters was eventually convicted and sentenced to 42 months in prison. Investigators traced the online threats back to PIA’s servers and subpoenaed the company. As the complaint reads, “A subpoena was sent to [Private Internet Access] and the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States.” McWaters engaged in several other identifying activities, according to the complaint, but PIA wasn’t among them. Despite such a clear view of a VPN provider upholding its no-logging policy, PIA didn’t impress me during my tests. It’s slightly more expensive than a lot of our top picks, and it delivered the worst speeds out of any VPN I tested, with more than a 50 percent drop on the closest US server. (Windscribe, for context, only dropped 15.6 percent of my speed.)

    MysteriumVPN is the go-to dVPN, or decentralized VPN, as far as I can tell. The concept of a decentralized VPN has existed for a while, but it’s really gained traction over the last couple of years. The idea is to have a network of residential IP addresses that make up the network, routing your traffic through normal IP addresses to get around the increasingly common block lists for VPN servers. Mysterium accomplishes this network with MystNodes. It’s a crypto node. People buy the node to earn crypto, and they’re put into the Mysterium network. It’s not inherently bad, but routing your traffic through a single residential IP is a little worrisome. Even without the decentralized kick, Mysterium was slow, and it doesn’t maintain any sort of privacy materials, be it a third-party audit, warranty canary, or transparency report.

    PrivadoVPN is one of the popular options to recommend as a free VPN. It offers a decent free service, with a handful of full-speed servers and 10 GB of data per month. You’ll have to suffer through four—yes, four—redirects begging you to pay for a subscription before signing up, but the free plan works. The problem is how new PrivadoVPN is. There’s no transparency report or audit available, and although the speeds are decent, they aren’t as good as Proton, Windscribe, or Surfshark. PrivadoVPN isn’t bad, but it’s hard to recommend when Proton and Windscribe exist with free plans that are equally as good.

    How We Test VPNs

    Functionally, a VPN should do two things: keep your internet speed reasonably fast, and actually protect your browsing data. That’s where I focused my testing. Extra features, a comfy UI, and customization settings are great, but they don’t matter if the core service is broken.

    Speed testing requires spot-checking, as the time of day, the network you’re connected to, and the specific VPN server you’re using can all influence speeds. Because of that, I always set a baseline speed on my unprotected connection directly before recording results, and I ran the test three times across both US and UK servers. With those baseline drops, I spot-checked at different times of the day over the course of a week to see if the speed decrease was similar.

    Security is a bit more involved. For starters, I checked for DNS, WebRTC, and IP leaks every time I connected to a server using Browser Leaks. I also ran brief tests sniffing my connection with Wireshark to ensure all of the packets being sent were secured with the VPN protocol in use.

    On the privacy front, the top-recommended services included on this list have been independently audited, and they all maintain some sort of transparency report. In most cases, there’s a proper report, but in others, such as Windscribe, that transparency is exposed through legal proceedings.

    [ad_2]

    Jacob Roach

    Source link

  • Australia warns social media platforms against age verification for all ahead of a ban on children

    [ad_1]

    MELBOURNE, Australia — Australian authorities said Tuesday that social media platforms should not demand age verification for all account holders starting from December, when a ban on children under 16 having accounts goes into effect in the country.

    The government released guidelines on how platforms such as TikTok, Facebook, Snapchat, Reddit, X and Instagram should apply the world’s first ban on children using social media from Dec. 10. It says verifying the ages of all account holders would be unreasonable.

    “We think it would be unreasonable if platforms reverified everyone’s age,” said Australia’s eSafety Commissioner Julie Inman Grant, who drafted the guidelines. Her use of the word “reverified” suggested the platforms usually already had sufficient data to verify a user was older than 16.

    She said the platforms have “targeting technology” to focus on those under 16.

    “They can target us with deadly precision when it comes to advertising. Certainly they can do this around the age of a child,” she added.

    Australia’s Parliament enacted the ban last year, giving the platforms a year to work out its implementation. The platforms face fines of up to 50 million Australian dollars ($33 million) for systemic failures to prevent children younger than 16 from holding accounts.

    Critics of the legislation fear that banning young children from social media will impact the privacy of all users who must establish they are older than 16.

    Inman Grant said claims the ban would see every Australian account holder subjected to age verification as a “scare tactic.”

    Communications Minister Anika Wells said the government seeks to keep platform users’ data as private as possible.

    “These social media platforms know an awful lot about us” already, Wells said. “If you have been on, for example, Facebook since 2009, then they know you are over 16. There is no need to verify.”

    Wells and Inman Grant will travel to the United States next week to discuss the guidelines with the platforms’ owners.

    Inman Grant said the platforms would need to demonstrate to her agency that they were taking “reasonable steps” to exclude children younger than 16.

    “We don’t expect that every under-16 account is magically going to disappear on Dec. 10,” Inman Grant said. “What we will be looking at is systemic failures to apply the technologies, policies and processes.”

    Melbourne’s RMIT University expert on information sciences Lisa Given told Australian Broadcasting Corp. that the government’s approach acknowledges that age verification technologies make errors.

    “It’s going to be up to each of the platforms to determine how they’re going to comply and it will be interesting to see if they test the limits of the definition of ‘reasonable steps,’” Given said.

    [ad_2]

    Source link

  • Ban on addictive social media feeds for kids takes shape with proposed rules

    [ad_1]

    New York’s attorney general on Monday proposed regulations for its crackdown on addictive social media feeds for children, including rules for verifying a user’s age.

    The Stop Addictive Feeds Exploitation (SAFE) for Kids Act, passed last year, prohibits social media companies from showing feeds personalized by algorithms to users under 18 unless they have a parent’s consent. Instead, feeds on apps like TikTok and Instagram would be limited to posts from accounts young users follow.

    The law also bars companies from sending notifications to users under 18 between midnight and 6 a.m.

    The proposed rules for implementing the provisions include standards for determining a user’s age and parental consent.

    “Companies may confirm a user’s age using a number of existing methods, as long as the methods are shown to be effective and protect users’ data,” Attorney General Letitia James’ office said.

    Options for confirming a user is at least 18, for example, include requesting an uploaded image or verifying a user’s email address or phone number to check against other information, the office said.

    Users under 18 who want to receive algorithmic feeds and nighttime notifications would have to give the companies permission to request consent from a parent.

    Supporters of the law said curated feeds built from user data are contributing to a youth mental health crisis by vastly increasing the hours young people spend on social media.

    “Children and teenagers are struggling with high rates of anxiety and depression because of addictive features on social media platforms,” James said in releasing the rules, which are subject to a 60-day public comment period.

    Online age check laws — on the rise in the U.S. — have garnered opposition from groups that advocate for digital privacy and free speech. More than 20 states have passed age verification laws, though many face legal challenges.

    The New York attorney general’s office noted Instagram and other social media platforms themselves have been implementing various forms of age assurance in recent months.

    “The incorporation of age assurance methods into the infrastructure of social media platforms is a positive development that demonstrates the technical and financial feasibility of age assurance methods for these platforms,” the office said. “Unfortunately, voluntary adoption of age assurance methods has not achieved the level of protection of minors required by the (SAFE) Act.”

    After the rules are finalized, social media companies will have 180 days to implement the regulations.

    [ad_2]

    Source link