Loading story…
Google updated Google Voice onboarding so new users must complete identity verification with government-issued ID (e.g., passport, national ID, driver’s license) before a newly assigned number can be used for calling or two-way messaging. The change is positioned as an anti-abuse control to reduce “gray market” acquisition and criminal misuse of Voice numbers for spam and other malicious activity, with automated checks, possible manual review, and limits on repeated verification attempts that can result in a number being barred from verification.
In Australia, a reported case involving a Victorian teacher highlights how government ID data (passport number) can be leveraged for account takeover, including an apparent phone-number transfer (consistent with a SIM-swap/number-port style event) that enabled interception of 2FA codes and subsequent access to bank and superannuation accounts. The incident is discussed in the context of rental application platforms and broader concerns about over-collection and exposure of sensitive identity documents, with reporting citing analysis that millions of leasing documents across multiple services may be accessible online without authentication—raising the likelihood of ID data theft that can be reused to defeat identity checks and facilitate financial fraud.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The Real Estate Institute of Australia noted that anti-money laundering reforms due to take effect on 1 July will require real estate agents to collect and retain more records. The change is expected to increase the volume of sensitive data held by the sector, potentially raising exposure if security controls are inadequate.
Google updated its Google Voice enrollment process so new registrants must complete identity verification with a government-issued ID before they can place calls, send messages, or otherwise use a newly assigned number. Google also limited verification attempts and warned repeated failures could permanently block a number from activation, citing abuse by gray-market and malicious actors.
The Real Estate Institute of Australia said agents need to verify tenant identity but should ensure the platforms they use meet privacy and security standards. It also supported efforts such as a federal digital ID rental pilot to reduce the amount of sensitive documentation renters must submit.
An Australian Housing and Urban Research Institute report warned that rental technology platforms can collect excessive amounts of personal data and distribute it across multiple third parties, increasing the risk of misuse and breaches. The report's lead author called for stronger regulation and said renters often lack visibility into platform security and downstream data handling.
A Victorian school teacher said he lost control of his mobile number and then saw unauthorized access to his bank and superannuation accounts, with fraudulent transfers made after an apparent identity compromise. He suspected the exposure stemmed from passport and other personal data he had uploaded to multiple online rental application platforms while applying for properties.
Guardian Australia reported that millions of leasing documents held by several online rental application platforms may be accessible online without authentication, raising concerns about systemic exposure of renters' personal information. The report linked these risks to broader concerns about over-collection and sharing of sensitive renter data across multiple third parties.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Identity and age verification controls are under strain as organizations expand remote onboarding and governments mandate stronger online age checks. Intellicheck’s analysis of nearly **100 million** cloud-based identity verification transactions in 2025 found an overall **97.85%** pass rate, but with significant variation by industry; failures were primarily driven by **expired IDs** (potentially indicating operational gaps, stolen credentials, or poor user hygiene) and **failed IDs** (often associated with attempted fraud and **synthetic identity** activity). Reported failure indicators included missing barcode authorization data, mismatches between barcode and printed fields, uploads that appear to be digital copies, and biometric mismatches between the presenter and the ID photo. In parallel, platforms and regulators are pushing broader deployment of online age assurance, raising privacy and security concerns about collecting and storing identity data at scale. Research cited in coverage of age verification initiatives (including Discord testing age checks and new requirements in the UK, France, and Australia) warns that expanded identity-data handling increases exposure to **breaches, identity theft, surveillance abuse, and discrimination**, even as it argues privacy-preserving approaches are feasible. Separately, Cisco’s *State of AI Security 2026* highlights that enterprises are rapidly integrating **agentic AI** into sensitive systems (ticketing, code repos, cloud dashboards) with limited security readiness; testing showed **multi-turn prompt-injection/jailbreak** techniques achieving up to **92%** success across eight open-weight models, underscoring the risk of automated workflows being steered into unsafe actions when agents have tool access and memory.
Jun 29, 2026
Google has expanded Android protections that tie a phone number to a device and Google accounts, while also adding **fake call detection** aimed at stopping deepfake-enabled phone scams. Reporting on the new anti-scam feature indicates Android can analyze calls for signs of impersonation and other fraudulent behavior, reflecting Google’s broader push to harden mobile devices against voice-based social engineering attacks. Separate reporting on Android’s phone number verification shows Google verifies that a SIM associated with a number is physically present in a device, then links that verified number to active Google accounts for services including **RCS messaging**, account recovery, emergency features, and anti-scam protections. The process has used hidden SMS messages and now increasingly relies on carrier APIs that exchange encrypted device and SIM-related data; the feature is enabled by default, can generate “number is now verified” alerts, and has raised privacy concerns because one verified number may be associated with multiple Google accounts on the same device.
Jul 22, 2026
A third-party site called **UK Visa Portal** publicly exposed sensitive immigration application records, including passport images and selfie photos uploaded by people seeking U.K. visa-related services. Reporting said at least **100,000 documents** were accessible online, and affected records were verified as authentic. The site is **not affiliated with the U.K. government**, but some applicants reportedly used it and paid for its services instead of submitting documents through the official **`GOV.UK`** portal. Efforts to alert the company were hampered by the absence of a clear security contact or identified management, and the exposure reportedly remained unresolved. Separate reporting highlighted a similar identity-data exposure involving **AU10TIX**, an identity verification provider used by major platforms including **TikTok**, **X**, and reportedly **Uber**. Researchers found exposed credentials that allegedly allowed access to logs containing names, dates of birth, nationalities, identification numbers, document types, and uploaded images of government-issued IDs such as driver’s licenses. The incident drew renewed scrutiny to outsourced age and identity verification systems, which concentrate highly sensitive personal data and can increase the risks of identity theft, phishing, blackmail, and loss of anonymity when security controls fail.
Jun 29, 2026