Security Newsletter | 11/27/25

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Limit which photos you share with apps. The latest privacy controls for iOS allow you to prevent apps from accessing your entire photo library and instead limit their access to specific photos.
2. Use a security key to lock your Apple Account. You can use physical keys to lock your Apple Account the same way you lock the front door to your house. These keys serve as a second form of authentication.
3. Review your Facebook privacy settings. Meta has never been the best when it comes to privacy, so if you’re a regular Facebook or Instagram user, be sure to check your privacy settings and limit the information you share with the apps.

Know someone with an Android phone? Well, sharing photos and videos with your Android friends will soon be much easier. Android’s version of AirDrop, Quick Share, has been upgraded on the new Google Pixel 10 family of phones to be compatible with Apple’s AirDrop. That means iPhones can now AirDrop photos and videos to Pixel 10 phones and vice versa. Google insists that Quick Share is secure and has a more detailed write-up about the more technical security details on its blog. While this upgraded version of Quick Share is currently only available on the Pixel 10 family of smartphones, Google says that it looks forward to “expanding it to more Android devices,” so hopefully, all Android phones will soon be able to use Quick Share.

The Bottom Line: Being able to quickly share photos and videos between Android and iPhone is great for convenience. However, just as you would with other iPhones, don’t accept AirDrops that you weren’t expecting. Both AirDrop and Quick Share can be used to share malicious files as well, so only accept AirDrops from people you know and trust.

Fighting Back Against Pig Butchering

The pernicious relationship investment scams that have cost US consumers millions of dollars over the past few years are facing concerted international pushback. The scams involve a scammer building a long-term relationship of trust with the intended victim, messaging back and forth for months or years. Then the scammer invites their mark to invest in a cryptocurrency trading scheme, which will ultimately cost them their entire savings and more. The scammers are usually operating in so-called “scam centers” along the border of Thailand and Myanmar, where people are often human trafficked, held against their will, and forced to execute scams. The US has formed a special task force to combat these scam centers. At the same time, the Myanmar military has teamed up with regional militia to demolish scam compounds, as well as liberate and repatriate the people held there. Reports suggest many thousands of imprisoned workers have been freed, at least for now.

The Bottom Line: International action is good, but the problem persists for now. Continue to practice caution whenever contacted by a stranger online. Verify identities by insisting on a video call, and watching out for any reference to too-good-to-be-true investment opportunities.

Congress Wants Meta Investigated Over Fraudulent Ads

Remember that Reuters report from a couple of weeks ago that said Meta makes 10% of its revenue from scam ads? Well, we weren’t the only ones to read it. Two US senators, Josh Hawley and Richard Blumenthal, wrote a letter to the Federal Trade Commission (FTC) and the Securities and Exchange Commission (SEC), urging them to investigate Meta’s ad revenue and penalize the company if Reuters’ report is accurate. A Meta spokesperson says that the senators’ letter is “exaggerated and wrong,” and that the company has “reduced user reports of scams by 58%.” You can read more at The Guardian.

The Bottom Line: We see no downsides to the FTC and SEC investigating Meta. If the company has really been fully aware of the amount of scam ads running on its platforms, it should be penalized.

Too Many People Are Reusing Passwords

Gen Z has worse password habits than Baby Boomers, according to a report from NordPass. The report says that 72% of Gen Z use the same password across multiple platforms, while only 42% of Baby Boomers reuse login credentials. However, Gen Z is more likely to use more secure login options like passkeys, Face ID, and multi-factor authentication. You can read more at The Independent or check out the report itself at NordPass.

The Bottom Line: If you want to avoid reusing passwords, the best thing you can do is start using a password manager. A password manager can create passwords and remember them for you. You should also use multi-factor authentication and passkeys for any accounts that support it.

Related: How Passkeys Work & How to Use Them on iPhone

FCC Undoes Requirements for Telecom Companies

Back in January, the FCC ruled that telecom companies would be required to secure their networks under the Communications Assistance for Law Enforcement Act. The ruling was made in response to attacks by Salt Typhoon, a hacking group linked to China, which compromised US networks last year. Under the new ruling, carriers and network providers would need to prioritize cybersecurity and protect their networks from foreign interference. This week, the FCC decided to roll back those rules. FCC Chairman Brendan Carr believes the ruling to be too broad, without any “real-world impact.” Instead, the FCC will leave it up to the carriers to voluntarily take proper precautions to protect their customers from cyberattacks. TechSpot has more details on the ruling.

The Bottom Line: The FCC’s January ruling would have been a benefit to consumers, so it’s disappointing to see it rolled back. According to the TechSpot article, the FCC will instead be pursuing “narrower, more targeted rules,” such as collaboration between telecom companies to better respond to threats.

Major Banking Vendor Hacked

SitusAMC, a vendor used by hundreds of banks for real estate transactions, was hit by a cyberattack on November 12. The company has since been working to determine what and how much data was stolen. Banks that rely on SitusAMC include JPMorgan Chase, Citi, and Morgan Stanley. While the banks themselves were not hacked, there is a possibility that client data was exposed in the breach. SitusAMC and the affected banks are working with the FBI to determine the extent of the damage. Read more about the incident at The New York Times.

The Bottom Line: It’s unclear what this means for customers who bank with the above companies. If this breach affects you, you will likely be notified in the coming weeks. In the meantime, we always recommend freezing your credit to help protect your identity.

Everything you need to know about Apple’s latest software updates.

• The most recent iOS and iPadOS is 26.1
• The most recent macOS is 26.1
• The most recent tvOS is 26.1
• The most recent watchOS is 26.1
• The most recent visionOS is 26.1

Read about the latest updates from Apple.

There is far too much security and privacy news for us to cover it all. When building this newsletter, we look for scams, hacks, trouble, and news to illustrate the kinds of problems Apple enthusiasts may encounter in our private lives, and the self-defense we can practice to keep our devices, accounts, and lives secure. Our commentary focuses on practical advice for everyday people. This newsletter was written by Cullen Thomas and Rhett Intriago and edited by August Garry.