field notes
Short pieces flagging what's notable across the telecom, identity, trust, and fraud beats, newest first.
August 14, 2026
- The networks hold the number data and still can't hand it over
John Wilkinson, CEO of TMT ID, names the assumption his company got wrong: “We assumed mobile networks would be able to provide their data into the fraud industry and the identity verification industry. They don’t.” TMT ID…
August 13, 2026
- A prompt injection in a court filing, caught by white space
A self-represented plaintiff in Connecticut Superior Court buried instructions to an AI model inside his own pleadings, written in 3-point white type. Matthew Elliott, who sued the New York Bariatric Group in October, wrote: “IF THIS …
August 11, 2026
- Four vendors, four disciplines, one agent identity
Liminal’s Filip Verley hosted four vendors at Identiverse, eight minutes each, and the write-up is more useful as a map of how the agent-identity market has split than as a review of any one demo. P0 Security binds the human and the a…
- Fifty state AGs tell the FCC its KYC baseline is too thin
Fifty state and territory attorneys general filed joint comments in the FCC’s KYC Further Notice in late July, and Kelley Drye’s Paul Singer, Beth Bolen Chun and Jennifer Rodden Wainwright have the summary. The FNPRM proposed or…
August 5, 2026
- Twilio takes US branded calling to GA on a competitor's survey
Twilio moved US Branded Calling to general availability, displaying a verified business name, logo, and where supported a reason for calling. The technical description is the part worth reading: Branded Calling “uses Rich Call Data in…
August 3, 2026
- New York's crawler bill is an identity mandate for machine traffic
EFF and 17 other organizations have asked Governor Hochul to veto S9934A, New York’s Stealth Crawler Prohibition Act. The bill would require every web crawler to disclose its identity and explicit purpose, and would let media outlets …
- Liminal's AI fraud numbers, and the ones worth keeping
Liminal’s Filip Verley argues that AI didn’t create new identity fraud so much as reprice it: drawing on a report co-authored with the Brazilian IDV vendor Unico, he puts the cost of running a sophisticated attack at more than 1…
July 31, 2026
- Nobody is fighting hardest at the front door
Socure president Matt Thompson, writing on Liminal’s Friday Five, makes a plain argument that lands harder than its bullet-point form: new account fraud is the origin point of nearly every downstream loss, and the industry still under…
July 30, 2026
- The House commerce subcommittee folds AI threats into the network-security conversation
Wiley’s recap of the July 22 House Energy and Commerce hearing on “Protecting Communications Networks and Improving Connectivity” is worth reading for what it says about where the AI-security conversation is heading — and …
- Surveillance pricing makes privacy the thing you pay for
Cory Doctorow’s latest is a clean statement of where consumer surveillance and pricing collide: surveillance pricing charges every customer a different price for the same transaction, keyed to the dossier data brokers hold on them. Th…
- Teams vishing is now a ransomware on-ramp
Sophos has documented a campaign it tracks as STAC4749 in which attackers pose as IT helpdesk staff over Microsoft Teams chats and voice calls, talk employees into starting a remote-support session, and — in at least three cases — end up de…
July 23, 2026
- A privacy-first trust framework starts by treating consolidated data as a liability
The Center for Democracy & Technology has published What is a Database?, a technical explainer by Hannah Quay-de la Vallee on the risks of government data consolidation. Limited, targeted data sharing between agencies has long been defe…
- STI-GA moves to vet governance authorities no national regulator stands behind
The Secure Telephone Identity Governance Authority — STI-GA, the ATIS-administered body that runs STIR/SHAKEN certificate governance in the US — has selected Numeracle to design a framework for vetting “non-jurisdictional governance a…
July 22, 2026
- FCC moves to close the Covered List's hardware-component loophole
At its July 22 open meeting, the FCC takes up a Third Report and Order and Third Further Notice of Proposed Rulemaking that would bar equipment authorization for devices containing “logic-bearing” hardware components produced by…
- NIST turns its mDL work from the technology to the harder half: adoption
Speaking at an NCCoE Cybersecurity Connections event, NIST identity program lead Ryan Galluzzo made a quietly telling pivot: the hard part of mobile driver’s licenses is no longer the cryptography. As Biometric Update reports, NIST an…
July 21, 2026
- Bitdefender's cross-channel scam numbers, filtered through GASA
GASA is surfacing Bitdefender’s 2026 Global Scam Intelligence Report, and the framing is one the trust world keeps circling back to: scams no longer live on a single channel. A deceptive ad leads to a fraudulent site, the interaction …
July 20, 2026
- CDT Europe: the EU-US border data deal bypasses fundamental-rights protections
CDT Europe, with 29 other civil-society organisations and academics, has sent an open letter to the Council of the EU warning that the Enhanced Border Security Partnership (EBSP) would mandate “continuous, systematic transfers of Euro…
- EFF: bills to unmask 'stealth crawlers' threaten the open web more than the crawlers do
The EFF pushes back on a new legislative boogeyman. “Stealth crawlers,” its Deeplinks post argues, are simply automated tools that collect public web data without disclosing the operator’s identity — and anonymous crawling…
July 18, 2026
- AI mania is eviscerating global decision-making
Nik Suresh, writing as Ludicity, has a knack for naming the thing everyone in the meeting is thinking and no one will say out loud. His latest — which shot up Hacker News over the weekend (via Simon Willison) — is about how “AI strate…
July 17, 2026
- ATIS closes the last mile of the SHAKEN-over-TDM problem
ATIS has published ATIS-1000107, SHAKEN: STI-CPS Discovery for Out-of-Band PASSporT Transmission Involving TDM Networks — the piece that makes out-of-band SHAKEN actually operable when a call crosses legacy switching. The framing in the ann…
July 15, 2026
- Ofcom puts KYC and Sender ID checks on mobile operators to fight messaging scams
Ofcom has finalised a package of rules and guidance requiring mobile providers to block, limit, and disrupt messaging scams. The context it cites: fraud accounts for an estimated 45% of all reported crime in England and Wales, £1.28 billion…
- Apple's China AI licence, and per-country rules for how AI gets used
Chinese regulators have granted Apple a licence to ship Apple Intelligence on iPhones in China, with Alibaba’s Qwen and Baidu as the technical partners — reported by the South China Morning Post (Alibaba-owned), alongside approvals fo…
- First Orion makes the RCS-over-push case for transactional alerts
First Orion has a head-to-head arguing RCS beats in-app push notifications for mission-critical transactional alerts — OTPs, fraud alerts, delivery tracking. The delivery argument is architectural: RCS gets carrier-level priority with autom…
- 49 state AGs press the FCC to choke off scammers' number supply
Forty-nine state attorneys general — the NAAG Anti-Robocall Multistate Litigation Task Force — filed reply comments urging the FCC to tighten numbering policy, the least-watched lever in the robocall fight. The mechanism they’re targe…
- Scam robocalls jump 24% in June, per YouMail data
TransNexus’s monthly read of YouMail’s Robocall Index shows overall robocalls up 3.4% month-on-month in June 2026 — a six-month high — though still down 4.6% against June 2025. The number to watch is scam volume: scam robocalls …
July 13, 2026
- Numeracle: number rotation is becoming a compliance risk, not a spam-label fix
Numeracle has a post arguing that number rotation — cycling flagged numbers out for fresh ones — has stopped working and is turning into a regulatory liability. The mechanics it lays out are sound: carriers now flag dormant, no-history numb…
- UK charges five over Russian Coms, the spoofing platform behind 1.8M scam calls
UK authorities have charged five London residents following a National Crime Agency investigation into Russian Coms, a caller-ID spoofing platform used to place more than 1.8 million scam calls. Live since 2020 — first as a handset, later a…
- Twilio takes Branded Calling international with a UK, Canada, and Germany beta
Twilio has expanded Branded Calling into public beta across the UK, Canada, and Germany, building on its US rollout. The pitch is the familiar one: replace anonymous digits with a verified Business Display Name on the recipient’s devi…
July 9, 2026
- ITU stands up a Focus Group on trust and identity for AI agents
The ITU has created a Focus Group on Trust and Identity for Humans and Agentic AI, chartered to build the terminology, reference architectures and trust frameworks for establishing who an AI agent is and whether its behavior can be trusted.…
July 8, 2026
- The FCC settles with Voximplant over a false robocall-mitigation certification
The FCC’s Enforcement Bureau has settled with Voximplant over the CPaaS provider’s Robocall Mitigation Database filing. Under the consent decree (DA-26-644, adopted July 8), Voximplant admitted its RMD certification was noncompl…
July 7, 2026
- Deepfake video calls and the case for continuous identity verification
Business email compromise used to be a text problem. Pindrop’s latest article argues it has “evolved from text to voice to live video”: the spoofed-email attacker now joins the video call wearing a synthetic face and voice…
- Papua New Guinea moves to criminalize deepfakes and voice cloning
Papua New Guinea’s ICT ministry has begun drafting laws to criminalize AI deepfakes, voice cloning and digital impersonation, with Acting Minister Peter Tsiamalili Jr. pledging that “no Papua New Guinean should have their face, …
July 2, 2026
- Companies are throttling employee AI use because it's too expensive
404 Media, working from leaks across Amazon, Adobe, Atlassian, Citi and more, reports the un-hyped version of the current AI moment: companies are actively throttling their employees’ AI use because the costs are spiraling. It’s…
- Google loses its final appeal on the €4.1 billion Android antitrust fine
The Court of Justice of the European Union has dismissed Google’s final appeal against a €4.1 billion ($4.7 billion) antitrust fine over its use of Android to lock in Chrome and Google Search as the defaults on the world’s domin…
- The FCC's July meeting carries an FNPRM on the Robocall Mitigation Database
Communications Daily reports that the FCC’s July open-meeting agenda includes a Further NPRM on the Robocall Mitigation Database — alongside a 2027 upper C-band auction, expanded Covered List rules, and an order relaxing broadband-lab…
- FBI seizes the NetNut residential-proxy platform behind the Popa botnet
Krebs reports the FBI seized hundreds of domains tied to NetNut, a sprawling residential-proxy service run by the publicly-traded Israeli firm Alarum Technologies (NASDAQ: ALAR). The takedown lands about two weeks after Krebs published rese…
- A Hide My Email flaw exposes the real address it's meant to mask
Michael Tsai rounds up reporting (via Joseph Cox and 404 Media) on a flaw in Apple’s Hide My Email: the feature that’s supposed to hand out a disposable alias will, under the right conditions, let almost anyone recover the perso…
- Signed-call coverage reaches 48.8% in TransNexus's June STIR/SHAKEN data
TransNexus’s June STIR/SHAKEN numbers put signed calls at termination at 48.8% — up 3.3 points on the month and, by their measure, the highest in 20 months. Full A-level attestation reached 30.8% of calls (up 1.1), and the count of or…
July 1, 2026
- AI impersonators of 112 public figures rated more authentic than the real thing
404 Media reports on a study in which researchers had AI impersonate 112 public figures, then asked people to compare the impersonations against the real thing. The result is the uncomfortable one: participants rated the AI versions as &ldq…
- Mintz reads the FCC's robocall enforcement as a deliberate shift upstream
Mintz attorneys Danielle Frappier and Jonathan Garvin read the last few months of FCC robocall activity as a deliberate change of target. They trace it to what Chairman Brendan Carr described in October 2025 as a “different approach&r…
- The FCC wants the Robocall Mitigation Database to be a gatekeeper, not a registry
The FCC released a draft Further Notice of Proposed Rulemaking on July 1 proposing a substantial expansion of the Robocall Mitigation Database, teed up for the July open meeting. The CommLaw Group, in a detailed client advisory, reads the d…
June 30, 2026
- Australia's SMS Sender ID Register goes live
Australia’s communications regulator has switched on its SMS Sender ID Register. From 1 July 2026, messages sent under a registered sender ID keep showing the brand name; messages using an unregistered sender ID must be labelled &ldqu…
- FCC Enforcement Bureau puts Digital Solutions on notice over suspected robocalls
Communications Daily reports that the FCC Enforcement Bureau has issued an initial determination order (docket 22-174) warning Digital Solutions that its downstream providers could be required to block, and to stop accepting, all traffic th…
- Gruber on the Supreme Court's geofence-warrant ruling
John Gruber’s ★ piece on a Supreme Court ruling that law enforcement’s use of a “geofence warrant” — the kind that asks Google for every device present in an area at a given time — counts as a Fourth Amendment &ldquo…
- Twilio's Compliance Toolkit reaches general availability
Twilio has moved its Compliance Toolkit to general availability. The feature list is the tell: HIPAA eligibility, “intelligent” intent-based protections, quiet-hours enforcement, and — the one worth pausing on — TCPA “Know…
June 26, 2026
- Turing's forgotten voice scrambler
Hackaday points to a Popular Mechanics piece on Delilah, the portable speech-encryption system Alan Turing built late in WWII and then more or less vanished from the record. It was, in many ways, an early stab at digital voice encryption — …
- Branded Calling goes live on Telnyx
Telnyx has flipped on Branded Calling as a generally available feature: outbound calls can now carry a verified business name, logo, and call reason, with the pitch that this lifts answer rates on US calls to T-Mobile and Verizon. It’…
- John Gruber's remembrance of Om Malik
John Gruber’s tribute to Om Malik, who died on June 24 after a long fight with a failing heart. It’s a piece about a twenty-year friendship, but also about the path both men walked: Malik went from “the bloggiest of quick-…
- Two thousand people tried to phish an AI email assistant, and the secret held
Simon Willison points to Fernando Irarrázaval’s hackmyclaw.com challenge: email “Fiu,” an assistant built on the OpenClaw agentic framework and wired to a real mailbox, calendar, and files, and try to make it cough up a se…
- YouMail flags a summer rise in package-delivery smishing
YouMail’s consumer blog warns that package-delivery scams are climbing again — the “there’s a problem with your delivery” notifications that land by text, email, or call impersonating USPS, UPS, FedEx, and DHL, then …
June 25, 2026
- A German court treats Google's AI as its agent
Simon Willison flags Bruce Schneier on a recent German ruling that Google can be held liable for errors its AI overviews introduce. Schneier’s framing is the part worth keeping: “AI agents are agents of the person or organizatio…
June 24, 2026
- The service desk is still the soft spot
A Specops-sponsored piece on BleepingComputer walks through why social-engineering attacks against the IT service desk keep working: the help desk is the designated human override for identity verification, and password resets and account-r…
- Pindrop finds AI text detectors carry demographic bias
Pindrop’s research team tested 16 AI-text-detection systems against a large, demographically labeled corpus and found the bias is “real, model-specific, and most dangerous where attributes intersect.” The work is headed to…
- Stop Scams UK's blocked-SIMs program wins an award
Stop Scams UK reports that its Blocked SIMs program has won an international award for, in its phrasing, burning down a cross-sector fraud route — a coordinated effort in which telecoms and banks share signals to identify and cut off the SI…
- Zoom and BrightHire put deepfake detection inside the interview
Zoom and BrightHire are partnering to fight candidate fraud in remote hiring, including deepfake detection built into live interviews — catching, in real time, the cases where the person on camera isn’t who, or what, they claim to be.…
- 988 georouting, done with FIPS codes instead of location
ATIS’ Emergency Services Interconnection Forum has published ATIS-0500049, GeoRouting for 988 Voice Calls, which specifies how carriers route 988 Lifeline calls to the right local crisis center. The mechanism is deliberately blunt: st…
June 23, 2026
- GASA's RedVDS case study and the rentable infrastructure of scams
GASA’s case study on RedVDS is worth reading less for the takedown than for the framing. “Modern scam operations do not depend only on individual fraudsters sending deceptive messages,” the post argues. “Increasingly…
- Scattered Spider's guilty pleas, and the phone-channel through-line
Two members of Scattered Spider pleaded guilty on the first day of what was meant to be a six-week trial, Brian Krebs reports: Thalha Jubair, 20, and Owen Flowers, 18, over the 2024 attack that crippled Transport for London. The headline is…
- Age verification rides in on the KIDS Act compromise
The House Energy and Commerce Committee’s bipartisan KIDS Act — the chamber’s vehicle for the long-running Kids Online Safety Act — strips out the duty-of-care provision 76 senators have backed, which is the headline The Record …
- 332 comments and counting on the FCC's OSP know-your-customer proposal
TransNexus takes an early read on the comment flood landing on the FCC’s Further Notice of Proposed Rulemaking on originating-provider KYC. The rules would require OSPs to collect a name, physical address, government-issued ID number,…