Connect with us

Technology

Could Microsoft's creepy 'Recall' AI feature become potent spy tool for crooks?

Published

on

Could Microsoft's creepy 'Recall' AI feature become potent spy tool for crooks?

Microsoft has announced a change in the rollout plan for the Recall preview feature on Copilot+ PCs. Instead of a broad preview release on June 18, 2024, as initially planned, Recall will first be made available to the Windows Insider Program in the coming weeks. By gathering feedback from Insiders, Microsoft aims to refine the feature further before making it available to all Copilot+ PC users.

Microsoft recently announced the “Recall” feature for Copilot+ PCs, an AI tool capable of recording everything on your screen. Recall is designed to act as a personal “photographic memory,” capturing periodic snapshots of your screen to create a visual timeline. It allows you to easily find and revisit content you’ve previously viewed across apps, websites, documents and more.

While the ability to instantly recall on-screen information could be incredibly useful, security researchers have exposed potential flaws that could expose personal data to malicious code. Maybe that’s why Microsoft, for the moment, is delaying its implementation in new computers being delivered this week.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

Copilot + PC logo (Microsoft) (Kurt “CyberGuy” Knutsson)

Advertisement

The nightmare scenario of recall as a spy tool

While Recall’s ability to surface past on-screen content could be incredibly useful, there are legitimate fears that the feature could become a potent spy tool and a potential “nightmare” if your device falls into the wrong hands.

Even if you use incognito mode or clear your browsing history, Recall still has full access to your entire on-screen history. Microsoft says the data never leaves your computer, but critics aren’t fully convinced.

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET

AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

Security researchers expose Recall’s risky flaws

The AI-informed system regularly snapshots what you’re doing on screen and lets you search for important data you may have lost track of as you work. However, security experts who examined Recall’s operation closely concluded that the system could pose serious security risks.

Advertisement

Recall is built into what Microsoft is calling “Copilot+” PCs – the tech giant’s vision of how traditional computers will become AI-powered workhorses. When it launched, Microsoft explained that Recall wouldn’t capture certain private content like Netflix videos or incognito browser sessions but would see everything else. In theory, this broad visibility makes Recall more useful for resurfacing lost work.

BEST ANTIVIRUS FOR PCS – CYBERGUY PICKS 2024

AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

BEST DESKTOP COMPUTERS FOR 2024

Flaws could expose personal data to malicious code

But security researcher Kevin Beaumont has already found very worrying flaws. In particular, the system stores data in a straightforward plain text system that malicious code could easily trawl through to find any personal data, from sensitive work files to private communications. He says the fear is that Recall makes it easier for malware and attackers to steal information. Beaumont admits Microsoft made some “smart decisions” around encryption, but he says they ultimately don’t work.

Advertisement

AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

BEST LAPTOPS FOR 2024

Potential for exposing sensitive information

He’s withholding full technical details for now to give Microsoft time to fix the loophole. But the potential for exposing everything from financial data to private health information is clear. Even if you trust Microsoft, bad actors could potentially find ingenious ways to exploit the tool’s treasure trove of data.

AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

SUBSCRIBE TO KURT’S YOUTUBE CHANNEL FOR QUICK VIDEO TIPS ON HOW TO WORK ALL OF YOUR TECH DEVICES

Advertisement

Balancing innovation and data protection

Whether Microsoft can swiftly resolve Recall’s security gaps or not, the revelations highlight how new AI capabilities often raise new privacy minefields that need to be carefully navigated. Innovative features and robust data protection will need to go hand-in-hand as AI plays a bigger role on our devices. While the debate rages on about Recall’s potential privacy implications, there are some proactive steps you can take to protect your data and use the tool more securely.

Ad for AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

Opt out if you’re uncomfortable

First and foremost, Recall is an opt-in feature during the initial device setup. If you have reservations, simply decline to enable it. Your computer will function normally without this “time machine” capability.

AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

Customize what Recall can see

If you do enable Recall, take advantage of the customization options to blacklist any apps, programs or websites you want to exclude from being recorded and indexed. This lets you pick and choose what Recall has access to.

Advertisement

Privacy and security page for AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

Use separate devices for different activities

One low-tech solution is to use dedicated devices for different purposes. Keep one computer for work, one for personal browsing and one for any ultrasensitive activities you want to completely wall off from Recall’s monitoring. As Recall evolves, look for guidance from Microsoft as adjusting your settings and adopting new privacy habits could become necessary.

Privacy and security page for AI feature called Recall (Microsoft) (Kurt “CyberGuy” Knutsson)

Addressing privacy and security concerns

In response to these privacy and security concerns, Microsoft has announced several updates to Recall:

  • Recall will be off by default, requiring users to proactively opt in to enable it.
  • Windows Hello enrollment and proof of presence will be required to view the timeline and search in Recall.
  • Additional layers of data protection, including “just in time” decryption protected by Windows Hello Enhanced Sign-in Security (ESS), will be implemented, ensuring snapshots are only decrypted and accessible when the user authenticates.
  • The search index database will be encrypted.

Microsoft has also reinforced its commitment to security, stating that all Copilot+ PCs will be Secured-core PCs with advanced firmware safeguards, Microsoft Pluton security processor enabled by default, and Windows Hello Enhanced Sign-in Security for more secure biometric sign-ins.

Privacy controls and user choice

Microsoft emphasizes that users will have control over what Recall captures and saves:

Advertisement
  • Snapshots are stored locally and not shared with Microsoft or other companies.
  • Users can pause, filter and delete snapshots at any time.
  • Digital rights managed or InPrivate browsing content will not be saved.
  • For managed work devices, IT administrators can disable the ability to save snapshots, but cannot enable it without user consent.

While Recall aims to provide a useful AI-powered experience, Microsoft acknowledges the importance of user trust and choice, positioning the preview as an opportunity to learn from real-world scenarios and refine the feature based on feedback.

Insider feedback and broader availability

Once the Recall preview is available in the Windows Insider Program, Microsoft will publish a blog post detailing how to access it. Participation in the Recall preview will require a Copilot+ PC due to hardware requirements.

After gathering feedback from the Insider community, Microsoft plans to make the Recall preview available to all Copilot+ PC users, incorporating insights and refinements based on real-world scenarios.

Microsoft’s response

We reached out to Microsoft, and a company rep steered us toward the company’s website, where they have this statement posted: “We are on a journey to build products and experiences that live up to our company mission to empower people and organizations to achieve more, and are driven by the critical importance of maintaining our customers’ privacy, security and trust. As we always do, we will continue to listen to and learn from our customers, including consumers, developers and enterprises, to evolve our experiences in ways that are meaningful to them.”

Kurt’s key takeaways

Microsoft’s Recall AI is currently in preview status, and while it is undeniably useful, it is also undeniably concerning from a privacy perspective. Keeping all that rich data exclusively local is smart but probably not an ironclad guarantee against potential misuse down the road. As always, with new tech, users will decide if the convenience is worth the potential risks for their own situation. For some, Recall may be a dream; for others, it could be a nightmare. Regardless, the debate shows that we still have work to do in striking the right balance between innovation and privacy in the AI era.

How do you balance the benefits of innovative AI features like Recall with the need for personal data protection and privacy? Let us know by writing us at Cyberguy.com/Contact.

Advertisement

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

Copyright 2024 CyberGuy.com. All rights reserved.

Advertisement

Technology

It’s MAGA v Broligarch in the battle over prediction markets

Published

on

It’s MAGA v Broligarch in the battle over prediction markets

Hello and welcome to Regulator, a newsletter for Verge subscribers about the love-hate (but mostly hate) relationship between Silicon Valley and Washington. I hope everyone got to celebrate George Washington’s birthday in their preferred manner: skiing, staycationing, subscribing to The Verge if you haven’t already, etc.

Prediction: this is going to be a mess

Political alliances are rarely permanent, so it’s somewhat predictable that the MAGA-tech bro alliance seems to have fallen apart in the span of a single year. Which side the administration would actually choose, though, was more difficult to foresee.

Last winter, it appeared that two groups were in a tenuous relationship, held together by Elon Musk’s shameless execution of the DOGE agenda and Big Tech signing massive checks to settle Donald Trump’s lawsuits against them. But last night, the Trump administration made a choice: the money. The Commodity Futures Trading Commission (CFTC) announced that they would sue any state who tried to regulate prediction markets like Kalshi — even the Republican states.

On Tuesday, the CFTC filed an amicus brief to the Ninth Circuit Court of Appeals, officially opposing an onslaught of lawsuits filed by the states against betting markets like Kalshi, Polymarket, Coinbase, and Crypto.com. (The latter two, known primarily as cryptocurrency exchanges, have partnered with Kalshi and created a standalone prediction market called OG, respectively.) But unusually, the brief was accompanied by a threat — posted on X, of all places. In a video directly facing the camera posted on Tuesday night, sole CFTC chairman Michael Selig asserted his commission’s authority to regulate prediction markets and stated that the federal government was prepared to sue: “To those who seek to challenge our authority in this space, let me be clear: we will see you in court.”

Advertisement

Had Selig simply written a staid Wall Street Journal op-ed asserting the CFTC’s authority (which he also did), that would have barely raised an eyebrow. But in 2026, a video threat, especially one posted on X, is basically grounds to instigate a political firestorm — one that Spencer Cox, the Republican Governor of Utah, gladly kindled. “Mike, I appreciate you attempting this with a straight face, but I don’t remember the CFTC having authority over the ‘derivative market’ of LeBron James rebounds,” he posted in response (also on X). “These prediction markets you are breathlessly defending are gambling—pure and simple. They are destroying the lives of families and countless Americans, especially young men. They have no place in Utah.” He promised that Utah would continue to pursue litigation and beat the federal government in court if need be.

This wouldn’t be the first time that Utah and Cox have voiced their opposition to federal overreach regarding emerging technology. Last year, they publicly opposed an executive order that would have given the Justice Department the power to sue states passing and enforcing AI regulatory laws. The prediction markets issue hits a particular nerve in Utah: nearly half of the state is Mormon, and the Church of Jesus Christ of Latter-day Saints officially opposes all government-sanctioned forms of gambling, even state lotteries. But Cox’s declaration is what’s known in political circles as a “weathervane”: if one deeply Republican state is pushing back against the Trump administration on a new front, who else on the right might follow suit — and what sorts of new broligarch technologies would they fight against?

Is it a coincidence that Anthropic CEO Dario Amodei’s big visit to Washington happened just as the Pentagon was reconsidering its relationship with the AI company? Over the past two weeks, Amodei published a 38-page letter to Congress warning of the rising existential risks of artificial intelligence, conducted an interview with Axios’s Mike Allen (and sponsored their newsletter), and met with Sens. Elizabeth Warren (D-MA) and Jim Banks (R-IN) on Capitol Hill to support their bill banning the sale of advanced AI chips to China.

But Amodei barely finished his capitol blitz when Axios broke the news over the weekend that the Pentagon wasn’t just impatient with Anthropic’s reticence to use Claude for unrestricted purposes, but that it would actively punish Anthropic for refusing to cooperate by designating them a “supply-chain risk.” If it goes through, any company that wants to work with the military would have to cut ties with Anthropic. As one Pentagon official described it, “It will be an enormous pain in the ass to disentangle, and we are going to make sure they pay a price for forcing our hand like this.”

The Pentagon’s move makes no sense for anyone who sees Claude as a superior AI enterprise product to its competitors at the Pentagon (Gemini, ChatGPT, and Grok). If viewed through the lens of every former interaction that Trump’s had with companies that voiced ideological opposition to his agenda however, their treatment of Anthropic is par for the course. Years ago, for instance, Trump threatened to cut off Amazon’s access to their sweetheart deal with the US Postal Service, in retaliation for Jeff Bezos’ ownership of the then highly critical Washington Post.

Advertisement

But for me, the question is: exactly what caused the ideological break, and how much of it was even about national security? In the past few months, there’s been a bizarre spurt of online messaging from right-wing influencers trying to claim that Anthropic, of all the AI companies, was too woke — the kind of woke that could convince kids to become trans, or DEI-pill them, or whatever lib-coded nightmares a MAGA personality could dream up. There wasn’t much proof that they could point to, other than its employees expressing opinions that could be lib-coded, if you’re not fully reading the entire tweet:

Screenshot va @KatieMiller/X.

Speaking of influencers eating their own:

  • Steve Bannon is under MAGA siege for his 2018 texts with Jeffrey Epstein, newly unearthed from the Justice Department’s Epstein Files, wherein he suggested that Trump should be removed from office using the 25th Amendment. Influencers calling for him to be questioned include Rep. Marjorie Taylor Greene, who broke from Trump and the GOP for trying to bury the Epstein Files, and retired Gen. Mike Flynn. Notably, both of them rose to prominence in 2020 by backing QAnon, the online conspiracy theory that claimed that an elite ring of Satan-worshipping pedophiles were in control of the government. (It may not help Bannon that he called Epstein “God” in one of the texts).
  • Mike Davis, an anti-Big Tech lawyer who previously represented Trump in his lawsuits against Meta, took credit for the ouster of former friend and ally Gail Slater from the Department of Justice’s antitrust division, according to texts obtained by The Free Press. Though the two were once allies due to their shared interest in holding Big Tech accountable, their relationship started fracturing over disagreements about when to enforce antitrust laws and when to go for settlements.
  • And we’re back to Bannon: per The Bulwark, he and fellow MAGA political operative Boris Epshteyn are being sued for their own shady cryptocurrency operation.

The White House is convening a third meeting between the crypto industry and the banking industry this week, continuing to hash out which major financial entity gets to reap the interests from yield-bearing stablecoin accounts (or if they get to bear interest at all). They have until March 1st to deliver draft language for the Senate. Good luck, y’all!

And finally, looksmaxxing Recess.

Can we all agree that HHS Secretary Robert F. Kennedy is framemogging Kid Rock in this video?

Advertisement

See you next week, and send all tips to every way that we list here.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading

Technology

Tax season scams 2026: Fake IRS messages stealing identities

Published

on

Tax season scams 2026: Fake IRS messages stealing identities

NEWYou can now listen to Fox News articles!

Tax season no longer begins in April. For scammers, it starts the moment the calendar flips to January. 

While you’re waiting for your W-2 or 1099 to arrive, cybercriminals are already sending out waves of fake IRS messages, “refund problem” alerts and account verification scams. These messages feel alarmingly real, and that’s not an accident.

The truth is, today’s tax scams don’t rely on random guessing. They rely on your personal data, pulled from online data brokers, public records and previous breaches. And once your information is in circulation, you become part of a high-value target list.

Let’s break down what’s really happening – and how you can protect yourself before the first fake message lands in your inbox.

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

ROBINHOOD TEXT SCAM WARNING: DO NOT CALL THIS NUMBER

Tax scammers are targeting Americans as soon as January with fake IRS emails and refund alerts designed to steal personal data. (Photo illustration by Michael Bocchieri/Getty Images)

The new wave of tax scams

Every year, scammers refine their tactics. And every year, they get better at making their messages look legitimate. Here are the most common scams hitting Americans before tax season even peaks:

1) Fake IRS emails and texts

These messages look official. They use real IRS language, government-style formatting and even fake case numbers. You might see something like:

Advertisement

“Your tax account is under review. Immediate action is required to avoid penalties.”

The email may include:

  • IRS logos and official-looking headers
  • Threatening language about audits or fines
  • A link that appears to go to a government website.

But when you click, you’re taken to a fake IRS portal designed to steal:

  • Your Social Security number
  • Your date of birth
  • Your bank account details
  • Your IRS login credentials.

Once scammers have that, they can file fake returns, redirect your refund or impersonate you for years.

2) ‘Refund Issue’ alerts

This is one of the most effective tax scams because it preys on something people are already waiting for: their money. The message usually says:

“Your tax refund has been delayed due to a verification issue. Please confirm your information.”

It feels believable. You just filed. You are expecting a refund. And the message arrives right when you’re checking your bank account.

Advertisement

The link leads to a perfect copy of:

  • A government site
  • A tax filing service
  • Or a bank login page.

Every keystroke you enter is captured. Scammers now have your identity, your financial access and your tax data – all from one click.

3) Benefit and identity verification scams

These scams impersonate the:

  • IRS
  • Social Security Administration
  • State tax offices.

Often, they use what seem to be legitimate titles like “tax resolution officer” and state that you have unresolved tax activity. They claim your benefits, tax records or identity are “on hold” and must be verified immediately.

Typical messages say: “Your benefits account has been temporarily suspended. Verify your identity to restore access.” Or: “We detected unusual activity on your tax profile. Confirm your information now.”

The goal is simple: panic. When people panic, they don’t slow down. They don’t double-check. They click. And once they do, scammers collect everything they need to fully impersonate the victim.

HOW TO SAFELY VIEW YOUR BANK AND RETIREMENT ACCOUNTS ONLINE

Advertisement

Cybercriminals use data broker profiles and breach records to personalize tax scams and make them appear legitimate. (Andrew Harrer/Bloomberg via Getty Images)

Why these messages feel so real

You may wonder: How do they know my name? My address? My tax service?

They don’t guess. They buy it. Data brokers collect and sell personal profiles that can include your:

  • Full name and address history
  • Phone numbers and email addresses
  • Family members and marital status
  • Estimated income and property records
  • Age, retirement status and employer history.

Scammers use this data to personalize their messages. That’s why the email doesn’t feel random. It feels meant for you. And once your profile is sold or leaked, it can be reused again and again.

The real target isn’t your refund. It’s your identity

Once scammers steal your Social Security number, tax ID or bank details, the damage doesn’t stop with one scam.

They can:

Advertisement
  • File fake tax returns
  • Open credit lines in your name
  • Redirect benefits
  • Sell your identity on criminal marketplaces.

Tax scams are often the entry point to long-term identity theft.

The ‘pre-tax season cleanup’ most people skip

Most people think clearing browser cookies or changing passwords is enough. It’s not. Your information still lives in data broker databases, where scammers shop for victims.

That’s why I recommend a data removal service that automates data removal and goes directly to the source. Instead of chasing scams one by one, these services help remove the reason you’re targeted in the first place.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Advertisement

Practical steps to protect yourself this tax season

Here’s what I recommend before filing:

  • Never click tax links from emails or texts. Go directly to official websites. Strong antivirus software can help block malicious links before they install malware or steal personal information. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
  • Use strong, unique passwords for tax services and email.  A password manager helps create and store strong, unique passwords and alerts you if your email appears in known data breaches. Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
  • Enable two-factor authentication (2FA) wherever possible.
  • Freeze your credit if you’re not applying for loans. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 
  • Remove your data from brokers before scammers find it, as discussed above.

2026 VALENTINE’S ROMANCE SCAMS AND HOW TO AVOID THEM

Fake “refund issue” messages trick taxpayers into entering Social Security numbers and bank details on fraudulent sites. (Photo illustration by Michael Bocchieri/Getty Images)

Kurt’s key takeaways

Tax scams don’t start in April; they start when your data is sold. The more complete your profile becomes, the easier it is for scammers to impersonate government agencies and steal your identity. By removing your personal data now, you’re not just protecting your refund; you’re protecting your future. This tax season, don’t wait for the alert. Remove the risk.

Have you received a suspicious IRS text or email this tax season, and what made you question whether it was real? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

The RAM crunch could kill products and even entire companies, memory exec admits

Published

on

The RAM crunch could kill products and even entire companies, memory exec admits

Phison is one of the leading makers of controller chips for SSDs and other flash memory devices — and CEO Pua Khein-Seng has now become a leading voice for just how bad the RAM shortage might get.

Companies may need to cut back their product lines in the second half of 2026, and some companies will even die if they can’t get the components they need, he agreed, in a televised interview with Ningguan Chen of Taiwanese broadcaster Next TV.

While the interview’s entirely in Chinese, friends of The Verge stepped forward to confirm parts of a machine-translated summary that’s been making headlines. They also note, importantly, that it’s the interviewer asking whether companies might shut down or product lines might discontinue. Khein-Seng largely just agreed and clarified that it’ll happen if these companies cannot secure enough RAM.

He also adds that he expects people will start fixing products more often when they break, instead of throwing them in the trash, over the next couple years.

It’s genuinely possible that some companies won’t be able to secure enough RAM. AI data centers are gobbling up the vast majority of the world’s memory supply as part of a global buildout, creating an unprecedented imbalance in supply and demand that’s seen RAM prices triple, quadruple, or even sextuple over the past handful of months. Even Nvidia might skip shipping a gaming GPU for the first time in 30 years. Even Apple may have trouble securing enough RAM now, not to mention memory chips for SSDs, and other vital components.

Advertisement

The RAM shortage may affect everything that computing touches over the next several years, as only three companies control 93 percent of the entire DRAM market, and while those three companies are building more facilities, they don’t want to build too fast. All three have decided to prioritize profits instead of risking overproduction that could lose them money later.

Tomorrow, February 19th, I’ll have a report on The Verge about how “RAMageddon” will affect you, even if you’d never think to buy a stick of memory yourself.

Continue Reading

Trending