New Mexico Attorney General Raúl Torrez won a historic sum of $375 million in a landmark child safety case against Meta earlier this year. But the next stage of the fight could be even more consequential for Meta and the social media industry at large.
Technology
Google Fast Pair flaw lets hackers hijack headphones
NEWYou can now listen to Fox News articles!
Google designed Fast Pair to make Bluetooth connections fast and effortless. One tap replaces menus, codes and manual pairing. That convenience now comes with serious risk. Security researchers at KU Leuven uncovered flaws in Google’s Fast Pair protocol that allows silent device takeovers. They named the attack method WhisperPair. An attacker nearby can connect to headphones, earbuds or speakers without the owner knowing. In some cases, the attacker can also track the user’s location. Even more concerning, victims do not need to use Android or own any Google products. iPhone users are also affected.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
APPLE WARNS MILLIONS OF IPHONES ARE EXPOSED TO ATTACK
Fast Pair makes connecting Bluetooth headphones quick, but researchers found that some devices accept new pairings without proper authorization. (Kurt “CyberGuy” Knutsson)
What WhisperPair is and how it hijacks Bluetooth devices
Fast Pair works by broadcasting a device’s identity to nearby phones and computers. That shortcut speeds up pairing. Researchers found that many devices ignore a key rule. They still accept new pairings while already connected. That opens the door to abuse.
Within Bluetooth range, an attacker can silently pair with a device in about 10 to 15 seconds. Once connected, they can interrupt calls, inject audio or activate microphones. The attack does not require specialized hardware and can be carried out using a standard phone, laptop, or low-cost device like a Raspberry Pi. According to the researchers, the attacker effectively becomes the device owner.
Audio brands affected by the Fast Pair vulnerability
The researchers tested 17 Fast Pair compatible devices from major brands, including Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech and Google. Most of these products passed Google certification testing. That detail raises uncomfortable questions about how security checks are performed.
How headphones can become tracking devices
Some affected models create an even bigger privacy issue. Certain Google and Sony devices integrate with Find Hub, which uses nearby devices to estimate location. If a headset has never been linked to a Google account, an attacker can claim it first. That allows continuous tracking of the user’s movements. If the victim later receives a tracking alert, it may appear to reference their own device. That makes the warning easy to dismiss as an error.
GOOGLE NEST STILL SENDS DATA AFTER REMOTE CONTROL CUTOFF, RESEARCHER FINDS
Attacker’s dashboard with location from the Find Hub network. (KU Leuven)
Why many Fast Pair devices may stay vulnerable
There is another problem most users never consider. Headphones and speakers require firmware updates. Those updates usually arrive through brand-specific apps that many people never install. If you never download the app, you never see the update. That means vulnerable devices could remain exposed for months or even years.
The only way to fix this vulnerability is by installing a software update issued by the device manufacturer. While many companies have released patches, updates may not yet be available for every affected model. Users should check directly with the manufacturer to confirm whether a security update exists for their specific device.
Why convenience keeps creating security gaps
Bluetooth itself was not the problem. The flaw lives in the convenience layer built on top of it. Fast Pair prioritized speed over strict ownership enforcement. Researchers argue that pairing should require cryptographic proof of ownership. Without it, convenience features become attack surfaces. Security and ease of use do not have to conflict. But they must be designed together.
Google responds to the Fast Pair WhisperPair security flaws
Google says it has been working with researchers to address the WhisperPair vulnerabilities and began sending recommended patches to headphone manufacturers in early September. Google also confirmed that its own Pixel headphones are now patched.
In a statement to CyberGuy, a Google spokesperson said, “We appreciate collaborating with security researchers through our Vulnerability Rewards Program, which helps keep our users safe. We worked with these researchers to fix these vulnerabilities, and we have not seen evidence of any exploitation outside of this report’s lab setting. As a best security practice, we recommend users check their headphones for the latest firmware updates. We are constantly evaluating and enhancing Fast Pair and Find Hub security.”
Google says the core issue stemmed from some accessory makers not fully following the Fast Pair specification. That specification requires accessories to accept pairing requests only when a user has intentionally placed the device into pairing mode. According to Google, failures to enforce that rule contributed to the audio and microphone risks identified by the researchers.
To reduce the risk going forward, Google says it updated its Fast Pair Validator and certification requirements to explicitly test whether devices properly enforce pairing mode checks. Google also says it provided accessory partners with fixes intended to fully resolve all related issues once applied.
On the location tracking side, Google says it rolled out a server-side fix that prevents accessories from being silently enrolled into the Find Hub network if they have never been paired with an Android device. According to the company, this change addresses the Find Hub tracking risk in that specific scenario across all devices, including Google’s own accessories.
Researchers, however, have raised questions about how quickly patches reach users and how much visibility Google has into real-world abuse that does not involve Google hardware. They also argue that weaknesses in certification allowed flawed implementations to reach the market at scale, suggesting broader systemic issues.
For now, both Google and the researchers agree on one key point. Users must install manufacturer firmware updates to be protected, and availability may vary by device and brand.
SMART HOME HACKING FEARS: WHAT’S REAL AND WHAT’S HYPE
Unwanted tracking notification showing the victim’s own device. (KU Leuven)
How to reduce your risk right now
You cannot disable Fast Pair entirely, but you can lower your exposure.
1) Check if your device is affected
If you use a Bluetooth accessory that supports Google Fast Pair, including wireless earbuds, headphones or speakers, you may be affected. The researchers created a public lookup tool that lets you search for your specific device model and see whether it is vulnerable. Checking your device is a simple first step before deciding what actions to take. Visit whisperpair.eu/vulnerable-devices to see if your device is on the list.
2) Update your audio devices
Install the official app from your headphone or speaker manufacturer. Check for firmware updates and apply them promptly.
3) Avoid pairing in public places
Pair new devices in private spaces. Avoid pairing in airports, cafés or gyms where strangers are nearby.
4) Factory reset if something feels off
Unexpected audio interruptions, strange sounds or dropped connections are warning signs. A factory reset can remove unauthorized pairings, but it does not fix the underlying vulnerability. A firmware update is still required.
5) Turn off Bluetooth when not needed
Bluetooth only needs to be on during active use. Turning off Bluetooth when not in use limits exposure, but it does not eliminate the underlying risk if the device remains unpatched.
6) Reset secondhand devices
Always factory reset used headphones or speakers before pairing them. This removes hidden links and account associations.
7) Take tracking alerts seriously
Investigate Find Hub or Apple tracking alerts, even if they appear to reference your own device.
8) Keep your phone updated
Install operating system updates promptly. Platform patches can block exploit paths even when accessories lag behind.
Kurt’s key takeaways
WhisperPair shows how small shortcuts can lead to large privacy failures. Headphones feel harmless. Yet, they contain microphones, radios and software that need care and updates. Ignoring them leaves a blind spot that attackers are happy to exploit. Staying secure now means paying attention to the devices you once took for granted.
Should companies be allowed to prioritize fast pairing over cryptographic proof of device ownership? Let us know by writing to us at Cyberguy.com
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
“Literally, we stopped selling to Amazon, and it’s because I wasn’t going to do something illegal. I wasn’t going to do something that would put at risk the relationship we have with other retailers. But it also set the stage to say, look, you’re not going to push me around. This is the way we do business. And so that’s how, over time, you build respect.”
NEWYou can now listen to Fox News articles!
Three weeks after her husband’s funeral, Carol’s phone rings. The caller knows her husband’s name, their address and their daughter’s name, even mentioning that she lives across town.
He says he’s calling from a life insurance company and that there’s a policy ready to be paid out. He just needs Carol’s Social Security number and bank routing details to process it.
This scenario draws from real scams reported by fraud investigators and elder abuse advocates across the country. The details change, but the playbook stays the same.
The reason these attacks work so well comes down to something most grieving families never think to check.
HOW SCAMMERS TARGET YOU EVEN WITHOUT SOCIAL MEDIA
Scammers build detailed profiles using obituaries, public records and data broker sites often within days of a loss. (Kurt “CyberGuy” Knutsson)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Why scammers target widows and how they find you so fast
Losing a spouse creates a perfect storm for scammers. Grief can leave you overwhelmed, and at the same time, you are handling financial decisions, paperwork and major life changes. That combination makes it easier for someone to catch you off guard.
THE ONE THING SCAMMERS CHECK BEFORE TARGETING YOU ONLINE
Meanwhile, your personal information becomes easier to find. Obituaries often include names, relationships and locations. Death records get filed with the Social Security Administration and added to the Death Master File. Probate filings can reveal property transfers, beneficiaries and account details.
Data brokers collect all of this and turn it into detailed profiles that almost anyone can access. According to research from a data privacy company analyzing five years of FBI Internet Crime Complaint Center data, about 52.5% of crimes reported by Americans over 60 in 2023 were either enabled or worsened by personal data available online. Widows, especially those managing estates alone, sit high on that target list.
Here’s what you should do in the first 90 days
Despite being in a high-risk group, taking these protective steps should keep scammers at bay. I know how overwhelming this time can be, so I recommend asking a trusted family member or friend for assistance setting things up. Though you should always refrain from sharing sensitive details like account numbers and your Social Security number.
THE DATA BROKER OPT-OUT STEPS EVERY RETIREE SHOULD TAKE TODAY
Days 1-30: Limit what enters the system
The first month is when the most damaging data gets published. So your first job is damage control.
1) Be strategic about the obituary
Obituaries are the single most accessible data source scammers use after a death. A traditional obituary lists full names, survivor relationships, hometowns and sometimes even ages. That’s a complete family map, and in the wrong hands, it can be a powerful weapon.
You don’t have to skip the obituary. But consider removing or abbreviating the exact home city (use the region instead), names of minor grandchildren and the surviving spouse’s first and last name combined with their address. “Carol of Cleveland” is safer than “Carol Patterson of 114 Birchwood Lane, Cleveland.”
HOW TO REMOVE YOUR PERSONAL INFO FROM PEOPLE-SEARCH SITES
2) Search your name on people-finder sites
Before you can remove anything, you need to see what’s already there.
Go to Spokeo, Whitepages, BeenVerified and Intelius. Search your name and your spouse’s name. What you find will likely include your address, phone number, email addresses, relatives’ names and property records.
This snapshot is your starting point. Take screenshots. You’ll need them.
10 SIGNS YOUR PERSONAL DATA IS BEING SOLD ONLINE
3) Set up a Google Alert for your name and address
It takes two minutes, and it’s free. Go to google.com/alerts and create alerts for:
- Your full name
- Your spouse’s full name
- Your street address.
If your information gets published anywhere new, you’ll get an email notification. This is your early warning system.
REMOVE YOUR PERSONAL INFO FROM THE WEB — STOP IT FROM COMING BACK
Days 31-60: Start removing and automating what you can’t do manually
People-search sites can expose your address, relatives and contact details, making it easier for scammers to target you. (Kurt “CyberGuy” Knutsson)
By now, your information has had weeks to spread. Manual opt-outs are worth doing, but here’s the reality: there are hundreds of data broker sites. Each one has its own removal process. Many require you to submit ID, wait days for confirmation and then re-submit when your data reappears, because it will.
1) Opt out of people-search sites
Prioritize manual opt-outs from the sites that appear in your Google search results. These carry the most weight because scammers often start with whatever Google surfaces first.
You can find these exposures quickly and easily with Incogni’s free scanner. This tool will scan the web for your personal information and email you a report with a list of results you can start with.
HOW TO HAND OFF DATA PRIVACY RESPONSIBILITIES FOR OLDER ADULTS TO A TRUSTED LOVED ONE
If you’d rather go about it on your own, some of the most common sites include:
- Spokeo: spokeo.com/opt_out/new
- Whitepages: whitepages.com/suppression_requests
- BeenVerified: beenverified.com/opt-out
- Intelius: intelius.com/opt-out.
Each one will ask you to verify your email. Follow through on every confirmation; unconfirmed requests don’t get processed.
Keep in mind that removing your information takes time and persistence. There are hundreds of data broker sites, and many of them re-list your information after it has been removed, especially when new public records become available.
Because of that, some people choose to use automated data removal services that send ongoing opt-out requests on their behalf. These services can help reduce the workload by continuously monitoring and removing listings as they reappear.
No matter which approach you take, consistency matters. Checking your information regularly and following up on removals helps limit what scammers can find.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
2) Update security questions on all financial accounts
This step is urgent, and most people skip it entirely.
Data broker profiles almost always contain the exact answers to your bank’s security questions. Mother’s maiden name. Previous address. City where you were born. Scammers use these to impersonate you and access your accounts.
WHAT HACKERS CAN LEARN ABOUT YOU FROM A DATA BROKER FILE
Call your bank, brokerage and insurance companies. Ask to update your knowledge-based authentication questions. Use answers that are completely made up, something only you know and store them in a password manager. Don’t use any answer that appears anywhere in a data broker profile.
Days 61-90: Lock down the perimeter
By now, the most urgent exposure has been addressed. These final steps close the remaining gaps and protect you in the long term.
1) Place a credit freeze on your account and your spouse’s
A credit freeze prevents new credit accounts from being opened in your name. It’s free at all three major bureaus: Equifax, Experian and TransUnion.
HOW TO SAFEGUARD YOUR CREDIT SCORE IN RETIREMENT AS FRAUD AND IDENTITY THEFT RISE AMONG SENIORS
Critically: freeze your spouse’s credit too. After a death, identity thieves frequently open new accounts in the deceased person’s name before the credit bureaus are updated. This is called ghosting, and it can haunt an estate for years.
To freeze a deceased spouse’s credit, contact each bureau individually and provide the death certificate. It’s a few phone calls. It’s worth every minute.
2) Request removal from the Social Security Death Master File
Families can submit a request to limit access to a deceased person’s Social Security data in certain contexts. Visit ssa.gov for current guidance. This won’t scrub the record entirely, but limiting access to the Death Master File reduces the pool of parties who can use it to enrich your data broker profile.
3) Review all joint account access and update beneficiary information
This isn’t directly a data privacy step, but it protects you from a related threat. Scammers who know about an estate sometimes pose as financial advisors, attorneys or government representatives to intercept beneficiary changes. Confirm all account changes directly through institutions you contact yourself, never through a number someone else gives you.
4) Set up simple safeguards to stop scams early
By this stage, your data is more controlled. Now the focus shifts to stopping scams before they escalate. Start by setting clear expectations with your family. Let them know you will never ask for money through an unexpected call, text or email. Creating a simple code word or check-in rule can stop panic-driven decisions, which is exactly what scammers rely on.
Next, slow down any urgent financial request. Scammers create pressure to force quick action. If someone claims there is a payout, problem or deadline, pause and verify it using a phone number or website you trust, not one they provide. It also helps to keep a short list of your financial institutions and their official contact details in one place. That way, you always know how to reach them directly without relying on incoming calls or messages.
Taking simple steps early, like removing your data and freezing your credit, can reduce your risk during the most vulnerable time. (Kurt “CyberGuy” Knutsson)
INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU
Finally, be cautious in real-time conversations. Scammers often build trust by collecting small details over multiple interactions. Keeping answers brief and avoiding unnecessary personal details makes it that much harder.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com
Get a free scan to find out if your personal information is already out on the web: CyberGuy.com
Kurt’s key takeaways
The first few months after losing a spouse bring enough decisions without adding fraud risks on top. Yet that is when your personal information spreads the fastest. Public records and data broker sites can quietly build a profile that scammers use against you. Early action makes a real difference. Limiting what gets published, removing existing data and securing your accounts all reduce your exposure. Even small steps, like updating security questions or freezing credit, can stop a scam before it starts. You do not need to handle everything at once. Start with a simple search of your name and review what appears. From there, take control at your own pace and protect what matters most.
If someone can piece together your personal life within days of a loss, how much of your information are you comfortable leaving online? Let us know by writing to us at CyberGuy.comCyberguy.com
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Beginning Monday, attorneys for Meta and New Mexico will return to a Santa Fe courthouse for a three-week public nuisance trial, where they’ll argue over the changes the AG wants the judge to order Meta make to Facebook, Instagram, and WhatsApp. Those changes include adding age verification for New Mexico users, prohibiting end-to-end encryption for users under 18 and capping their use to 90 hours per month, limiting engagement-boosting features like infinite scroll and autoplay, and requiring Meta to detect 99 percent of new child sexual abuse material (CSAM).
“From the outset, our goal was to try and change the way the company’s doing business,” Torrez told The Verge on a recent visit to Washington, DC, to advocate for new kids safety legislation. “I recognize that even at $375 million for a company this big and this profitable, it’s not enough in and of itself to change the way they’re doing business. In fact, there’s probably some folks in that company who think of it as the cost of doing business.”
“Even at $375 million for a company this big and this profitable, it’s not enough in and of itself to change the way they’re doing business”
While any changes ordered by the judge would only apply to Meta and its operations in New Mexico, the company could apply the changes in other states for the sake of simplicity. Or, as it’s threatened to do, it could simply go dark in the state. A court order could send a message to other tech companies that courts may be willing to alter their businesses if they’re found liable.
During the trial, New Mexico will argue Meta has become a public nuisance by creating a public health hazard in the state. The AG’s office expects to call on about 15 witnesses, including experts who will testify to the feasibility of their proposed remedies, and fact witnesses who will testify about Meta’s alleged harms. After Meta makes its defense, Judge Bryan Biedscheid will evaluate which proposals are relevant and feasible — a process that could take some time, compared to the speedy turnaround of the jury verdict in March.
A sweeping win for New Mexico could energize Torrez and thousands of other plaintiffs currently pursuing cases against tech companies. Conversely, a limited order could be a significant blow. The outcome won’t directly impact other cases, but it will almost certainly color negotiations over potential settlements.
Several of Torrez’s requests are hot-button tech policy issues. Age verification would almost certainly require Meta or a third-party provider to collect more personal information on adults and minors alike, which privacy advocates have consistently warned can make users less safe. Don McGowan, who previously served on the board of the National Center for Missing and Exploited Children (NCMEC), said that barring encrypted communications on platforms like Facebook “is a great way to make sure that nobody uses Facebook Messenger anymore and just moves their activity to other platforms that aren’t touched by this lawsuit.”
The mandate may do little to change the reality of certain parts of the business — Meta recently announced it was getting rid of end-to-end encrypted messaging on Instagram that it said “very few people” actually used.
Peter Chapman, associate director of the Knight-Georgetown Institute, which works to connect policymakers and others with independent tech policy research, said there could be “significant tradeoffs” to a prohibition on encryption, and other changes may be more effective. For example, evidence presented by the state showed that Meta’s own profile recommendations were connecting adults and minors, a feature that poses a clearer danger of harm without much benefit, and which Torrez is also asking the court to stop. “There’s an opportunity to intervene at that level and try to prevent more of these harmful interactions from taking place without having to tackle encryption,” said Chapman.
No single feature change is likely to solve the entire child and teen safety problem, said Chapman, which is why it’s notable that Torrez plans to ask for several layers of changes. Still, the overall effectiveness of any given remedy will also depend on how it’s implemented and monitored. For instance, what would be the methodology Meta uses to report a 99 percent detection rate of new CSAM? How does it count or surmise what it hasn’t caught? The same goes for the accuracy and reliability of any mandated age verification.
Meta points to this potential issue in its argument against Torrez’s proposed remedies. “Regardless of where the accuracy threshold is set, Meta would never be able to prove that the system met that standard, because doing the calculation would require that Meta detect 100% of CSAM to use as the denominator,” the company wrote in a legal filing. Torrez’s chief deputy, James Grayson, said on a press call that the court and an appointed independent monitor would have some discretion over tracking; the office hasn’t yet identified who this monitor would be.
“The demands that are being made in New Mexico are ill-informed and provide massive additional exposure for other kinds of exploitation”
Meta and other groups that oppose the AG’s approach say the outcomes he’s seeking are counterproductive. “The demands that are being made in New Mexico are ill-informed and provide massive additional exposure for other kinds of exploitation,” said Maureen Flatley, president of Stop Child Predators, a group that advocates for more funding for enforcement of criminal laws against child predators, and has received funding from Meta-backed trade group NetChoice. “This notion that the platforms have to be responsible for pushing all these people out would be like saying to the US Bankers Association, ‘By the way, you are responsible for all the bank robberies from now on,’ which is ludicrous.”
“The New Mexico Attorney General’s focus on a single platform is a misguided strategy that ignores the hundreds of other apps teens use daily,” Meta spokesperson Chris Sgro said in a statement. “The state’s proposed mandates infringe on parental rights and stifle free expression for all New Mexicans. Regardless, we remain committed to providing safe, age-appropriate experiences and have already launched many of the protections the state seeks, including 13 safety measures this past year.”
But Torrez has taken aim at the broader tech industry, too. He recently visited Washington, DC, to advocate for new protections for kids online and an overhaul of Section 230, the law that protects tech platforms from being held liable for their users’ posts. “While we were able to prevail in our district court in Santa Fe, I still think the law as it currently exists creates a lot of ambiguity,” he told The Verge on that visit. “If Section 230 were not something that these companies could hide behind, then it increases the chances that they’re going to have to actually make their case to a jury.”
But Chapman said regulation through lawsuits isn’t an “uncommon sort of story” in the US. “Whether that’s tobacco, opioids, e-cigarettes, there is precedent for legal action moving a broader policy conversation.”
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
-
New York1 hour agoRudy Giuliani Hospitalized in Florida in ‘Critical Condition’
-
Detroit, MI2 hours agoHow Detroit Pistons Completed Playoff Series Comeback With Game 7 Win Over Magic
-
San Francisco, CA2 hours agoThe San Francisco Giants Have Never Cast A Smaller Shadow | Defector
-
Dallas, TX2 hours agoFC Dallas ended its winless streak and one new scorer made it sweeter
-
Miami, FL2 hours agoWinners and losers from F1’s eventful Miami Grand Prix
-
Boston, MA2 hours ago2 men arrested after armed home invasion with shots fired in Saugus, police say
-
Denver, CO2 hours agoWATCH THE PENULTIMATE SUPERCROSS IN DENVER IN UNDER 24 MINUTES – Motocross Action Magazine
-
Seattle, WA2 hours agoSeattle Mariners claim LHP José Suarez from next opponent – Seattle Sports