Happy ceasefire day and welcome to Regulator, a newsletter for Verge subscribers about Big Tech’s rocky journey through the world of politics. If you’re not a subscriber yet, you can do so here, but my only request is that you sign up before Donald Trump decides to revisit his previous threats toward Iran and kickstart World War III.
Technology
Holiday deliveries and fake tracking texts: How scammers track you
NEWYou can now listen to Fox News articles!
As we head into the last stretch of December (and last-minute gift shopping), your doorstep is probably busier than ever. And if you’re anything like me, you’re probably also juggling shipping updates, tracking numbers, and “out for delivery” alerts from half a dozen retailers.
Unfortunately, scammers know this too, and they’ve likely been preparing for it all year. Like clockwork, I’ve already started seeing the usual wave of fake tracking texts hitting people’s phones. They look legit, they show up right when you’re expecting a package, and they rely on one inescapable truth: during the holiday rush, most of us are too overwhelmed to notice when something feels off.
No need to panic, though. You can still come out ahead of the scammers. I’ll show you what to look out for and how you can prevent being targeted in the first place.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
THE FAKE REFUND SCAM: WHY SCAMMERS LOVE HOLIDAY SHOPPERS
Holiday shoppers are being hit with a surge of fake delivery texts designed to steal personal information and account logins. (Photo by Sebastian Kahnert/picture alliance via Getty Images)
What fake delivery text messages look like
Most of these fake shipping texts include a “tracking link” that looks close enough to the real thing that you might tap without thinking twice about it. In some cases, like one Maryland woman found out, you may even receive fake deliveries with a QR code that works in a similar way.
These links usually lead to a spoofed tracking page that looks almost identical to the real thing. It’ll ask you to “confirm” your login or enter your delivery details. The moment you type anything in, scammers capture it and use it to access your real accounts.
Even worse, the “tracking link” may contain malware or spyware, triggering silent installs that can steal passwords, monitor keystrokes, or give scammers remote access to your device.
Red flags that reveal fake shipping and tracking messages
So how can you distinguish between a legitimate message for a delivery you’re actually waiting for and one of these scams? Here are the red flags I look for:
- Weird or slightly altered URLs. Scammers use domains that look almost right. Except there’s usually one extra letter, a swapped character, or a completely unfamiliar extension.
- Requests for additional payment. Real carriers don’t ask you to pay a “small fee” to release a package. That’s an instant giveaway.
- A package you’re not expecting. If the text is vague or you can’t match it to a recent order, pause before you tap anything.
- Delivery attempts at odd hours. “Missed delivery at 6:12 AM” or “late-night attempt” messages are usually fake. Carriers don’t normally operate like that.
- Updates that don’t match what you see in the retailer’s app or email. If Amazon says your package is arriving tomorrow, but a random text says it’s delayed or stuck, trust Amazon, not the text.
- Language that is designed to rush you. Anything screaming “immediate action required!” is designed to make you stop thinking and start tapping.
If a text triggers any one of these, I delete it on the spot. When in doubt, always check directly with the delivery service provider first before opening any links.
WHY YOUR HOLIDAY SHOPPING DATA NEEDS A CLEANUP NOW
Scammers are sending deceptive tracking links that mimic real carriers, hoping rushed shoppers won’t notice red flags. (Silas Stein/picture alliance via Getty Images)
How scammers know your address, phone number, and shopping habits
Scammers don’t magically know where you live or what you’ve ordered — they buy that information. There’s actually an entire industry of data brokers built on collecting and selling personal data. This can include your:
- Phone number
- Home address
- Purchase history
- Browsing patterns
- Retailers accounts and apps
- Loyalty programs
- Even preferred delivery times.
These data brokers can sell profiles containing hundreds of data points on you. And they aren’t always discerning about who they sell to. In fact, some of them have been caught intentionally selling data to scammers.
Once scammers have those details, creating a convincing delivery scam is no problem.
But scammers can’t target what they can’t find
I’ve been very vocal about the importance of keeping personal information under lock and key. And this is just one of the reasons why.
Criminals rely on your personal information to target you with these types of scams. They also need at least a phone number or email address to reach you in the first place.
So your best bet to avoid delivery scams (and, honestly, most other scams year-round) is removing your info from data brokers and people search sites. Doing this will keep your details out of circulation online and out of the wrong hands.
FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE
Fraudsters use spoofed shipping pages and malware to capture passwords and gain access to victims’ devices. (Martin Ollman/Getty Images)
How to remove your personal information from scammers’ reach
You can start by looking yourself up online. Searching for different combinations of your name, address, email, and phone number should bring up a bunch of people search sites. Just visit the “opt-out” page on each site to request removal of your data.
Private-database data brokers are a bit trickier. They sell data in bulk, usually to marketers and other third parties. So you won’t be able to check if they have your information. But if you look into which data brokers operate in your area, you can just send opt-out requests to them all. There’s a good chance they’ll have your information.
You can also turn to a data removal service. They completely remove the headache from this process and just automatically keep your personal info off data broker sites. If, like me, you don’t have the time to keep manually checking data broker sites and sending removal requests every few months (because your data will keep reappearing), a personal data removal service is the way to go.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
Kurt’s key takeaways
Holiday delivery scams work because they blend perfectly into the chaos of December shopping. A well-timed text and a familiar tracking link are often all it takes to lower your guard. By slowing down, checking messages directly with retailers, and reducing how much of your personal data is circulating online, you can take away the advantage scammers rely on. A little caution now can save you a major headache later.
Have you received a suspicious delivery text or tracking message this holiday season? If so, tell us what it looked like and how you handled it by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
Copyright 2025 CyberGuy.com. All rights reserved.
YouTube Shorts is rolling out a new AI-powered feature giving creators an easy way to realistically clone themselves on camera. The launch, hinted at earlier this year, reflects the platform’s fraught relationship with AI-generated content, adding more generative features while struggling to contain AI slop, deepfake scams, and impersonations.
YouTube says the new tool will let users create a digital version of themselves, called an avatar, that can be inserted into existing Shorts videos or used to generate entirely new ones. The company said avatars will “look and sound like you,” framing them as a safer and more secure way to use AI to create new content.
Creating an avatar is a bit more involved than simply pressing a button, but it sounds fairly straightforward. In a blog post outlining the process, YouTube said users must first record a “live selfie” capturing their face and voice while following a series of prompts. For the best results, the company recommends good lighting, a quiet area, a background free of other people or images of faces, and holding the phone at eye level.
Once avatars are made, users can select “make a video with my avatar” while creating a video to generate a clip from prompts, which can be up to eight seconds long, according to 9to5google. Users can also add their avatar to “eligible Shorts” in their feed, though YouTube did not specify what makes a Short eligible.
The AI avatar feature comes with fairly tight restrictions. They can only be used in the creator’s own original videos, who also control whether their Shorts can be remixed. The creator can delete their avatar or videos where it appears at any time, YouTube says. Avatars that aren’t used to create new content for three years will be automatically deleted.
Not everyone will be able to use the feature immediately. YouTube says the tool “will be rolling out gradually,” though it did not give a timeline or indication of where it will be available first. Creators must also be at least 18 and own an existing YouTube channel, the company says.
Its arrival comes as one of Google’s main AI rivals, OpenAI, pulls back from video generation. The startup said it was sunsetting its Sora video tool last month after a year of struggling to get the wannabe social platform off the ground. It was costly and faced a parade of copyright challenges, deepfake controversies, and slop that made it an unattractive bet for investors ahead of an anticipated IPO this year.
NEWYou can now listen to Fox News articles!
You see a charge you don’t recognize. It looks like it came from a trusted brand. Your instinct kicks in. You want to fix it quickly and move on. That’s exactly what happened to Dorothy.
After a simple text, she found herself on the phone with someone who sounded official, confident and completely convincing. Here’s how she described it:
“I received a text from APPLE Pay, which I don’t even use… It said an Apple Store in CA wants to charge me $144… If I have questions, I should call. DUH! I called and was speaking with the scammer.”
“I received a text from APPLE Pay, which I don’t even use… It said an Apple Store in CA wants to charge me $144… If I have questions, I should call. DUH! I called and was speaking with the scammer.”
Within minutes, the situation escalated.
“He knew everything about me… He said I should take out $15,000… He said he was working with the FBI and the FDIC.”
That’s when the pressure really started. Dorothy told me this story when she joined me on my Beyond Connected podcast, and what happened next shows just how far these scams can go.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
10 WAYS TO PROTECT SENIORS FROM EMAIL SCAMS
The text sent to Dorothy shows how a fake Apple Pay alert uses urgency and a phone number to pull you into a scam. (Kurt “CyberGuy” Knutsson)
How this Apple Pay text scam actually works
This scam follows a pattern that is becoming more common. It combines a fake alert with a live phone call designed to build trust fast.
Here’s what is happening behind the scenes:
Step 1: The fake charge alert
You get a text about a suspicious charge. It looks urgent. It often includes a number to call.
Step 2: You call the scammer
The number connects you directly to a criminal. They pose as Apple, your bank or even law enforcement.
Step 3: They build credibility
They may know your name, address or bank. That information often comes from past data breaches.
Step 4: They create fear and urgency
You are told your money is at risk. You need to act immediately.
Step 5: They control your next move
In Dorothy’s case, the scammer told her to withdraw $15,000 and lie to her bank about why.
“He said he would stay on the phone with me while I drove to the bank… If anyone asked, I should say I was buying a car.”
That is a major red flag.
PHISHING SCAM EXPLOITS APPLE MAIL ‘TRUSTED SENDER’ LABEL
Once you call, scammers pose as trusted companies or agencies and pressure you to act quickly. (Kurt “CyberGuy” Knutsson)
The moment everything could have gone wrong
Dorothy drove to the bank with the scammer still on the phone. This is exactly what criminals want. They try to isolate you and keep control of the situation.
But something didn’t feel right.
“When I got to the bank, I recognized one of the employees and told her that I was uncomfortable… She said to hang up immediately.”
That decision changed everything.
The bank confirmed it was a scam. The calls kept coming from different numbers. Dorothy blocked them all. Fortunately, no money was lost.
Why the Apple Pay text scam feels so real
Scammers are getting better at one thing. They make you feel like you are solving a problem, not being scammed.
Here’s why this one works so well:
- It uses a trusted name like Apple Pay
- It creates urgency with a fake charge
- It moves quickly to a live conversation
- It uses real personal details to build trust
- It pressures you to act before you think
They also add authority. Claiming ties to the FBI or FDIC makes people feel like they must comply. In reality, no legitimate agency will ever ask you to move money this way.
The biggest red flags to watch for
If you remember nothing else, remember these:
- A text about a charge that tells you to call a number
- Someone is asking you to withdraw large amounts of cash
- Instructions to lie to your bank or keep a secret
- Claims that your money needs to be “protected”
- Pressure to act immediately
Each one is a warning sign. Together, they confirm it is a scam.
The biggest red flag is being told to move money or keep secrets from your bank or family. (Kurt “CyberGuy” Knutsson)
How to stay safe from Apple Pay text scams
You do not need to outsmart scammers. You just need to slow the situation down.
1) Never trust the number in the message
If you get a suspicious text, do not call the number provided. Look up the official number yourself.
2) Pause before you act
Scammers rely on urgency. Take a moment. Real companies will not rush you like this.
3) Never move money on someone else’s instructions
No bank, tech company or government agency will ask you to withdraw cash to “protect” it.
4) Use strong antivirus software
Strong antivirus software can help detect malicious links, block scam websites and warn you before you engage with risky content. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
5) Remove your personal data from the web
Scammers often use data from breaches to sound convincing. A data removal service can help reduce your exposure and limit what criminals can find about you online. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
6) Talk to someone you trust
A quick conversation with a friend, family member or bank employee can stop a scam cold.
7) Add extra protection
Consider identity monitoring services that alert you if your information is being misused. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.
What to do if this happens to you
Even if you did not lose money, take a few steps right away:
- Contact your bank using the number on your card
- Place a fraud alert on your credit
- Consider freezing your credit
- Monitor your accounts closely
- Block any follow-up calls or texts
These steps help protect you from future attempts.
What this means for you
This scam did not begin with a complex hack. Instead, it started with a simple text. That is what makes it so dangerous. At first, it looks routine. Then urgency takes over. As a result, anyone can feel pressured to act quickly and without thinking.
In many cases, the situation feels real. That is how people get pulled into a conversation that seems legitimate. In Dorothy’s case, she trusted her instincts at the right moment. Because of that decision, fortunately, she did not lose $15,000.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Kurt’s key takeaways
Scammers target more than technology. They focus on human behavior. They create pressure, build trust and keep you engaged long enough to make a mistake. However, you can break the cycle. A single pause can disrupt the scam. Asking one question can expose it. Even a quick conversation with someone you trust can stop it. If you’d like to hear more of Dorothy’s story, you can catch our full conversation on my Beyond Connected podcast at getbeyondconnected.com/
If you got a text like this right now, would you pause or would you call? Let us know by writing to us at Cyberguy.com.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
I’m back after being waylaid last week by the deadly combo of a moderate cold and the beginning of pollen season. (Twenty-one percent of the District’s acreage is taken up by public green space, and DC is consistently ranked the best city park system in America. Unfortunately, I am allergic to every tree and grass.) If you’ve got tips on anything I may have missed or anything I should know about the upcoming weeks, send ’em to tina.nguyen+tips@theverge.com.
Do you actually believe anything OpenAI says?
On Monday, OpenAI published a 13-page policy paper addressing the impact that artificial intelligence would have on the American workforce. The company also proposed what it believed was the solution: putting higher capital gains taxes on corporations replacing their workers with AI and using that money to create a bigger public safety net. Its solutions included a public wealth fund, a four-day workweek funded by “efficiency dividends,” and government programs to help transition workers into “human-centered” work, all financed by the abundance that artificial intelligence would deliver.
Unfortunately, it was released the day that The New Yorker’s Ronan Farrow and Andrew Marantz published a meticulously reported, 17,000-word-plus article chronicling Sam Altman’s history of lying to everyone around him, including to his Silicon Valley backers, his employees, his board, and — relevant in this case — lawmakers trying to regulate AI. The New Yorker article reinforced a long-standing narrative about Altman, and OpenAI by extension: They may spout idealistic values, but would quickly jettison them for financial and political gains.
On its own, said several people I spoke to, the paper was a net positive to AI governance overall, in that it introduced new ideas into the political discourse around the emerging technology. But unless the company’s policy and political influence made good on those promises, said OpenAI’s critics, it may as well just be a piece of paper.
“My guess is that there are people on the team who care about the stuff, who’ve thought really hard about this document and are proud of it, and did good work, even if it’s not addressing all of the questions that I wish it would address,” Malo Bourgon, the CEO of the Machine Intelligence Research Institute (MIRI), told me. “And there’s still the question of: Are those people gonna find themselves in the position that many previous people at OpenAI have found themselves in, where they thought the company had certain values or aligned with things they cared about, and then ended up finding out that wasn’t the case, becoming disenchanted and leaving?”
With OpenAI proposing policy, it’s worth looking back at its history with the government, which the New Yorker piece details in depth. Altman had been one of the first major CEOs to publicly advocate for federal oversight for AI, going so far as to propose a federal agency to oversee advanced models in 2023 — but privately he worked to suppress the laws containing his own safety proposals. A state legislative aide in California accused OpenAI of engaging in “increasingly cunning, deceptive behavior” to kill a 2023 AI safety bill that it was publicly supporting. In 2025, the company subpoenaed supporters of a California state-level AI bill in an effort to, as one such supporter put it to The New Yorker, “basically scare them into shutting up.” And though Altman had once worked extensively with the Biden administration to build AI safety standards, the moment that Donald Trump became president, Altman successfully persuaded him to kill the initiatives he’d once advocated for.
Nathan Calvin, the general counsel at Encode, an AI policy nonprofit where he focuses on state legislative initiatives, had received one of those subpoenas. “What I’ve seen from their policy and government affairs engagement has just been abysmal,” he told me. While he believed that the team who’d written the OpenAI proposal, primarily from the technical safety research side, was acting with good intentions, he was still reserving judgment. “Will those folks remain engaged as we move from general policy principles towards the many other ways in which lobbying and government influence actually happens? Part of me is hopeful, but a lot of me is also quite skeptical about whether that will happen.” (OpenAI did not return a request for comment.)
A modest, absolutely not craven request:
Next week I plan on running an issue of Regulator cataloging the nerdiest events happening during Nerd Prom, aka the White House Correspondents’ Dinner party circuit. If you’re a tech founder, tech company, or someone that does something related to technology and you’re throwing an event during WHCD week, please let me know what you’re up to! From what I’ve heard so far, the tech world is about to shake up the normal social dynamics of the week — I’ve already caught wind of the Grindr party in Georgetown, and the Substack party, which famed looksmaxxer Clavicular is attending — and I’m so, so excited to pull together the most bonkers “SPOTTED” column that Washington’s ever experienced.
(Again, this is contingent upon whether we’re at war with Iran by the end of April, in which case, I imagine no one will be up for frivolity.)
Speaking of DC reporters, this is very true of all of us:
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
Detroit, MI1 hour ago
Detroit Lions Should Be Greatly Interested in Pittsburgh Steelers Trade Rumor
San Francisco, CA2 hours ago
BART restores services on Red, Yellow lines after equipment issue disrupted services to SFO
Dallas, TX2 hours ago
Pooh Shiesty ordered held on kidnapping charges tied to armed dispute with Gucci Mane, Dallas judge rules
.jpg?w=80&resize=80,80&ssl=1 "American Airlines Eyes April 30 Return to Venezuela With Miami–Caracas Flights")
Miami, FL2 hours ago
American Airlines Eyes April 30 Return to Venezuela With Miami–Caracas Flights
Boston, MA2 hours ago
Family of Stephenson King, man killed by Boston police officer, wants body camera video released
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Virginia2 years ago
99th annual Pony Swim held in Virginia
Indiana2 years ago
Indiana Members Credit Union announced as new anchor tenant at Bottleworks District
News9 hours ago
Video: The Fragile Cease-Fire in Iran
Politics10 hours ago
Spanberger ripped after taking credit for billions in investments secured under GOP predecessor: ‘Pathetic’
World11 hours ago
Newsletter: NATO holds amid fragile Iran ceasefire
News11 hours ago
Jim Whittaker, the first American to summit Mount Everest, dies at 97
News21 hours ago
Video: Military Families Bear the Burden of War, Again
-
Atlanta, GA5 days ago1 teenage girl killed, another injured in shooting at Piedmont Park, police say
-
Culture1 week agoDo You Know Where These Famous Authors Are Buried?
-
Movie Reviews1 week agoVaazha 2 first half review: Hashir anchors a lively, chaos-filled teen tale
-
Education1 week agoVideo: We Put Dyson’s $600 Vacuum to the Test
-
Georgia2 days agoGeorgia House Special Runoff Election 2026 Live Results
-
Pennsylvania3 days agoParents charged after toddler injured by wolf at Pennsylvania zoo
-
Milwaukee, WI3 days agoPotawatomi Casino Hotel evacuated after fire breaks out in rooftop HVAC system
-
Entertainment1 week agoInside Ye’s first comeback show at SoFi Stadium