Consumer News: Southwest Airlines revamps frequent flyer program with new rewards and benefits

The average 30-year mortgage rate held steady at 7.40% this week

By Mark Huffman of ConsumerAffairs

• Mortgage rates held steady this week, with the average 30-year fixed-rate mortgage remaining at 7.40%, according to Freddie Mac.

• The pause ended seven consecutive weeks of increases, but rates remain at their highest level since November 2023.

• Housing affordability remains a major challenge, with higher borrowing costs, elevated home prices and economic uncertainty keeping many prospective buyers on the sidelines.

After nearly two months of steadily rising borrowing costs, prospective homebuyers finally got a break this week although it wasn't much of one.

The average interest rate on a 30-year fixed-rate mortgage remained unchanged at 7.40% for the week ending October 15, according to Freddie Mac's latest Primary Mortgage Market Survey. That matched last week's rate and ended a seven-week streak of increases.

Despite the pause, mortgage rates remain at their highest level in nearly three years. The last time rates were higher was November 16, 2023, when the average reached 7.44%.

A year ago, the average 30-year mortgage rate was just 6.27%, underscoring how dramatically borrowing costs have increased over the past 12 months.

The average rate on a 15-year fixed-rate mortgage, often used by homeowners refinancing an existing loan, edged lower to 6.71% from 6.73% last week. A year earlier, it averaged 5.52%.

What higher rates mean for homebuyers

The increase in mortgage rates has significantly reduced purchasing power, particularly for first-time buyers already struggling with elevated home prices.

Consider a buyer taking out a $350,000 mortgage. At this week's average rate of 7.40%, the monthly principal and interest payment would be approximately $2,423.

At the 6.27% average rate a year ago, that same loan would have required a monthly payment of about $2,160.

That's an increase of approximately $263 a month, or more than $3,100 a year, without accounting for property taxes, homeowners insurance or other housing expenses.

The increase also means some buyers who qualified for a mortgage a year ago may no longer qualify for the same loan amount.

Why mortgage rates remain elevated

Mortgage rates are closely tied to yields on 10-year U.S. Treasury bonds, which have risen sharply amid persistent inflation concerns, higher energy prices and uncertainty about future Federal Reserve interest rate decisions.

Although the Federal Reserve does not directly set mortgage rates, its monetary policy influences bond markets and lenders' borrowing costs.

Treasury yields have retreated somewhat after reaching multidecade highs, helping interrupt the recent rise in mortgage rates. However, inflation concerns continue to limit the potential for a sustained decline.

The higher rates are also weighing on mortgage demand. According to the Mortgage Bankers Association, mortgage applications declined 2.7% during the week ending October 9, marking the sixth consecutive weekly decrease.

Will mortgage rates fall anytime soon?

Prospective homebuyers hoping for a return to mortgage rates below 6% may face a long wait.

Fannie Mae's latest forecast projects the average 30-year fixed mortgage rate will remain at approximately 7.4% during the final quarter of 2026 before rising to an average of 7.5% in 2027.

The Mortgage Bankers Association also expects rates to remain above 7% next year, suggesting that today's elevated borrowing costs could persist well into the future.

Those forecasts are subject to change, particularly if inflation slows more quickly than expected or economic growth weakens.

For consumers planning to purchase a home, the latest numbers reinforce the importance of shopping around for a mortgage. Rates can vary considerably among lenders, and obtaining quotes from several companies could result in meaningful savings over the life of a loan.

Buyers should also consider the total monthly cost of homeownership, including insurance, property taxes and maintenance, rather than focusing solely on the interest rate.

But customers may need to activate some of them to get the protection

By Mark Huffman of ConsumerAffairs

• Verizon is promoting free security tools designed to protect customers against fraudulent calls, malicious websites and threats to their personal information.

• Call Filter can identify and block suspected scam calls, while Digital Secure offers additional protection against online threats.

• Customers can access many of these features through My Verizon or Verizon's security apps, although some advanced protections require a paid subscription.

With scammers increasingly using sophisticated technology to trick consumers into revealing personal information or sending money, Verizon is reminding its customers that they may already have access to tools that can help protect them.

The wireless carrier says its customers can take advantage of several security features, including spam-call blocking, protection against malicious websites and tools to help secure mobile devices.

In an October announcement, Verizon emphasized that some of these services are available at no additional cost, meaning customers may not need to purchase separate security subscriptions to receive basic protection.

The company also maintains an online consumer safety resource center with recommendations for protecting phones, passwords and personal information.

Blocking suspected scam calls

One of Verizon's primary fraud-prevention tools is Call Filter, which screens incoming calls to identify suspected spam, robocalls and potential fraud.

The free version can automatically send high-risk spam calls to voicemail. It also allows customers to review blocked calls, report suspicious numbers and create a list of numbers that should be allowed through.

Verizon says the service uses continually updated databases and analytics to identify suspicious calls, including those involving spoofed telephone numbers.

For customers who want additional protection, Call Filter Plus offers enhanced caller identification, number lookups and more personalized blocking options. Verizon lists the price at $3.99 a month for a single line or $10.99 a month for three or more lines.

However, the company acknowledges that no screening system will catch every fraudulent call. Legitimate calls can also be mistakenly flagged as spam.

Protecting phones from online threats

Verizon is also promoting Digital Secure, a service intended to protect connected devices from malicious websites and potential security vulnerabilities.

The complimentary version provides basic online protection, while the premium service offers additional security features.

Verizon says it is currently offering customers a free one-month trial of Digital Secure Premium, allowing them to evaluate the additional protections before deciding whether to pay for the service.

The company also encourages customers to use strong passwords, enable device locking features and keep security software updated.

These precautions are particularly important because a stolen or compromised smartphone can provide criminals access to email, banking applications, saved passwords and other sensitive information.

Other tools for families

Verizon's safety efforts extend beyond financial fraud.

Its Verizon Family service includes location sharing and Safe Walk features that allow family members to stay connected when traveling or walking alone.

The company says these features are available at no additional cost and can be particularly useful for parents who want to keep track of their children's whereabouts.

While these services aren't specifically designed to prevent financial , they are part of Verizon's broader effort to improve customer safety.

How customers can activate the protections

Verizon customers interested in using these services can start by reviewing the security features associated with their accounts.

1. Sign in to My Verizon. Open the My Verizon app or visit Verizon's website and look under Products & plan perks for available security services.

2. Activate Call Filter. On compatible phones, download or open the Verizon Protect app. The app is preinstalled on many Android devices. Customers with incompatible phones may be able to manage Call Filter through My Verizon.

3. Review spam-blocking settings. Check which calls are being blocked, add trusted telephone numbers to an allowed list and report suspicious calls that get through.

4. Explore Digital Secure. Review the free security features and determine whether the premium trial offers protections worth using. Check the subscription terms before the trial ends.

5. Secure your device and accounts. Enable a strong screen lock, use unique passwords and keep your phone's operating system and applications updated.

Verizon says the Verizon Protect app requires Android 10 or later or iOS 16.6 or later. Availability can vary by device.

Customers can find more information on Verizon's consumer safety website and its Call Filter support page.

No protection is foolproof

Although these services can reduce consumers' exposure to , they cannot eliminate the threat.

A fraudulent call might still get through, and a scammer could use a text message, email or social media account instead of a telephone call.

Consumers should be particularly suspicious of unexpected requests for passwords, account verification codes, banking information or immediate payments.

Anyone receiving a suspicious call claiming to be from Verizon, a bank or a government agency should hang up and contact the organization using a verified telephone number or its official website.

The bottom line for Verizon customers is that some potentially useful protections are already included in their wireless service. Taking a few minutes to review and activate them could help reduce the risk of becoming a fraud victim.

Regulators say the company used thousands of accounts to get around ticket limits.

By Mark Huffman of ConsumerAffairs

• The Federal Trade Commission has sued a major ticket broker, accusing it of illegally bypassing ticket-purchasing limits to acquire millions of tickets to concerts and other popular events.

• The company allegedly purchased more than 18.5 million tickets, spending over $1.3 billion and generating at least $120.8 million in resale profits.

• One Beyonc concert generated $833,000 in profits, according to regulators, after the company allegedly used 1,300 accounts to purchase more than 7,600 tickets.

Consumers who have struggled to buy tickets to popular concerts and sporting events, only to find them available on resale websites at much higher prices, may now have a better understanding of why that happens.

The Federal Trade Commission has filed a lawsuit against California-based ticket broker REPS & Company Inc., alleging the company systematically evaded ticket-purchasing restrictions to acquire millions of tickets that it resold at substantial markups.

According to the FTC's announcement, the alleged practices violated the Better Online Ticket Sales Act, commonly known as the BOTS Act, which prohibits circumventing technological safeguards intended to enforce ticket-purchasing limits.

Millions of tickets purchased

The FTC alleges that since 2022, REPS has used a variety of techniques to get around restrictions imposed by ticket sellers, including Ticketmaster and AXS.

The scale of the operation was enormous, according to the complaint. Federal regulators say REPS purchased more than eight tickets for at least 83,500 events, many of them highly popular performances likely to sell out.

In total, the company allegedly spent more than $1.3 billion to acquire more than 18.5 million tickets, generating at least $120.8 million in profits through resale.

One example cited by regulators involved a 2023 Beyonc Renaissance tour concert in Kansas City, Missouri.

The FTC alleges REPS used approximately 1,300 different ticket-purchasing accounts to acquire 7,624 tickets for that single performance. The company then generated approximately $833,000 in profits from reselling those tickets.

REPS entire business model is focused on trying to game the ticket-purchasing system in order to obtain as many tickets as possible to resell at inflated prices to consumers, said Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection.

How the alleged scheme worked

Most major ticket sellers limit how many tickets an individual can purchase for a particular event. The restrictions are intended to give more fans an opportunity to purchase tickets directly, rather than having to pay inflated resale prices.

Ticket sellers enforce those limits by monitoring customer accounts, credit cards, email addresses, telephone numbers and internet addresses.

According to the FTC, REPS developed an elaborate operation to defeat those safeguards.

The company allegedly employed workers, most of them based in the Philippines, who operated thousands of purchasing accounts using different identities, addresses and telephone numbers.

Regulators say the company also used virtual credit cards, proxy internet services and specialized browsers that disguised the identities and locations of ticket buyers.

When ticket sellers detected suspicious activity and blocked purchases, REPS employees allegedly made small changes to names or addresses to get around the restrictions.

The FTC says internal company documents show that executives discussed ways to prevent their accounts from being detected and blocked.

For consumers, the lawsuit does not currently establish a refund program or a process to claim compensation for tickets purchased at inflated prices. However, the case could have broader implications for the ticket resale industry if regulators succeed in demonstrating that the alleged purchasing methods violated federal law.

Spyware can now infect computers through online ads without a single click

By Mark Huffman of ConsumerAffairs

• Researchers have uncovered the first confirmed cases of sophisticated spyware being delivered through online advertisements without requiring users to click on anything.

• At least 45 devices at the international news organization Al Jazeera were targeted in attacks linked to an Israeli advertising company and a commercial spyware developer.

• Security experts warn that the technique could expose millions of internet users to surveillance, raising new concerns about the safety of digital advertising.

Internet users have long been warned not to click on suspicious advertisements. But a newly uncovered cybersecurity threat suggests that simply visiting a website or opening an app displaying an advertisement could be enough to compromise a device.

Researchers at the University of Toronto's Citizen Lab have documented what they describe as the first confirmed cases of zero-click mercenary spyware delivered through targeted online advertising.

In a report, the researchers identified a technique they call "AdFection," which allows attackers to infect targeted computers without requiring victims to click a link, download a file or take any other action.

The investigation, conducted with cybersecurity company Confiant, found that an Israeli advertising company called Discover-Tech allegedly used the infrastructure of legitimate digital advertising networks to deliver sophisticated surveillance software.

The findings suggest that technology designed to show consumers advertisements based on their interests and browsing habits can also be exploited to identify, track and potentially hack specific individuals.

Dozens of devices targeted

The researchers identified attacks during 2024 and 2025 involving at least 45 devices at Al Jazeera, the international news organization based in Qatar.

The attacks were linked to spyware developed by Candiru, an Israeli surveillance technology company that has previously been placed on a U.S. government trade blacklist.

According to the investigation, devices first connected to infrastructure operated by Discover-Tech after encountering advertisements. They subsequently communicated with servers associated with Candiru's spyware.

Researchers concluded that the advertising system was being used to deliver malicious software directly to targeted devices.

The investigation also uncovered evidence of surveillance-related advertising activity reaching computers and networks associated with government agencies, international organizations and major technology companies. However, researchers did not establish that all those devices were infected.

How the attacks work

Most online advertising operates through automated auctions. When someone opens a website or app, advertisers compete in fractions of a second to display an advertisement.

Those auctions use information about the consumer, including location, browsing activity and device identifiers, to determine which advertisements to display.

Citizen Lab found that Discover-Tech operated a platform called Controlium, which allegedly allowed surveillance operators to use that same information to identify particular individuals and deliver malicious code.

The process could unfold without the consumer noticing anything unusual.

An advertisement might appear normally, or it might load in the background. The advertisement could then contact a remote server, which would determine whether the device was an intended target.

If it was, the server could return malicious code designed to exploit a software vulnerability and install spyware.

Unlike conventional phishing attacks, the victim would not need to open an attachment or click a suspicious link.

The scale of the operation was considerable. Researchers examined nearly four billion advertising bidding records and found that Discover-Tech advertisements appeared on more than 120,000 websites and 70,000 mobile applications during a four-month period in 2026.

That does not mean every device displaying those advertisements was infected. The researchers said the infrastructure also appeared capable of collecting information about large numbers of users to identify potential surveillance targets.

What spyware can do

Mercenary spyware differs from ordinary advertising trackers and most consumer malware.

It is sophisticated surveillance software typically sold to governments and intelligence organizations, often for substantial sums of money.

Depending on the software and the device's vulnerabilities, an infection may allow an attacker to obtain private messages, emails, files and other sensitive information. Some spyware can also activate microphones or cameras without the owner's knowledge.

The newly documented attacks are particularly concerning because victims may have no indication that their devices have been compromised.

The investigation does not establish that ordinary consumers are being infected on a widespread basis. Such sophisticated attacks have historically concentrated on journalists, political activists, government officials and other high-value targets.

Nevertheless, the findings demonstrate that the advertising infrastructure used by millions of ordinary consumers can be exploited for much more intrusive surveillance.

Advertising companies take action

Following the investigation, several major advertising companies moved to restrict Discover-Tech's activities.

Google terminated the company's access to its advertising exchange platforms and deployed Safe Browsing protections for known malicious domains.

The advertising industry organization IAB Europe removed Discover-Tech from its approved vendor listings. Other advertising companies, including Beeswax, Vungle and Eskimi, also blocked or suspended the company's access.

Discover-Tech and representatives associated with Candiru did not respond to requests for comment reported by WIRED before publication.

How consumers can protect themselves

Although zero-click attacks are difficult to prevent, cybersecurity specialists say consumers can take several precautions to reduce their exposure.

• Use a reputable ad blocker. Blocking advertising scripts can reduce opportunities for malicious advertisements to reach a device, although it cannot guarantee protection.

• Keep operating systems and browsers updated. Security updates can close vulnerabilities that sophisticated spyware relies on.

• Limit advertising tracking. Turn off personalized advertising where possible and periodically reset mobile advertising identifiers.

• Be cautious about unfamiliar apps. Download software from trusted sources and review permissions.

• Take additional precautions if you're at elevated risk. Journalists, activists and others who may be targeted for surveillance should consider specialized security assistance and stronger device protections.

The larger challenge, researchers say, is that individuals cannot fully protect themselves against attacks that exploit the infrastructure of legitimate advertising networks.

The discovery raises questions about how thoroughly advertising companies screen the businesses that purchase ads and whether current safeguards are adequate to prevent surveillance companies from exploiting those systems.

For consumers, the findings add a troubling new dimension to online privacy: An advertisement does not necessarily have to be clicked or even noticed to become a security threat.