Scammers can copy a name, a logo and a job title in a minute. A few checks you can run yourself show whether a “support agent”, recruiter or business partner is real.

A message lands on Telegram: “Hi, I’m Daniel from the security team at your exchange. We saw a login from a new device. Please confirm your wallet so we can protect your funds.” The profile photo shows the company logo. The English is good. Daniel is patient, and he knows your username.

Daniel does not work at the exchange. He works for a scam crew, and the “confirm your wallet” link empties your wallet.

People reported losing $3.5 billion to imposter scams in 2025, and nearly $1 billion of that went to people pretending to be a business, according to the FTC’s June 2026 report. The FBI’s figure for crypto is bigger. Victims told its Internet Crime Complaint Center they lost $11.4 billion to crypto-related crime in 2025, more than half of all the losses it counted that year (IC3 2025 report).

A lot of those losses started the same way. Someone claimed to work for a company, and the victim took their word for it. Some victims did not know how to check. Others saw a familiar name, a logo and a confident tone, and felt no need.

The checks run from a 30-second test to reading the hidden part of an email. If you only have time for two, use the first and the tenth: both are free, and both are very hard for a scammer to fake.

The one rule behind every check

Never use the contact details a stranger gives you to check that stranger.

If “Daniel” sends you a phone number, a website or an email address and says “contact us here to confirm”, all three belong to Daniel. Calling the number he gave you only proves that Daniel answers his own phone.

Every check in this list works the same way. You find the company’s official channel yourself, from a source the stranger did not hand you. Then you ask that channel whether the person is real.

Why people skip the check

It looks official, so we assume it is. A logo, a job title and a company name take a minute to copy. Real staff photos sit on LinkedIn and on company “Team” pages for anyone to download.

They already know something about us. Your username, your last order or the exchange you use is often public, or leaked in a data breach. Knowing those details says nothing about who the sender is.

There is a clock. “Your account will be frozen in 30 minutes.” The deadline is there to stop you checking. A real company will still exist after you spend ten minutes confirming.

The more urgent the message, the slower you should move.

13 ways to check that someone works for a company

1. Contact the company yourself, through its official website

Type the company’s address into your browser by hand, or use a bookmark you saved earlier. Skip links in the message and skip search ads, because scammers buy ads for fake support pages. Find the support page or contact form and ask: “Someone called Daniel, Telegram @daniel_sec_team, says he works on your security team and contacted me today. Is that real?”

Example. A “recruiter” emails about a job at a well-known firm. You open the firm’s careers page from a bookmark. The role is not listed, and the HR address on the page is another one. The recruiter does not work for the firm.

The catch is speed. If support takes two days to reply, wait two days, and do nothing the stranger asks in the meantime.

2. Use the company’s own checking tool

Many crypto exchanges now run a page where you paste a username, email, phone number or link, and it tells you whether the contact is official. Three examples:

• Binance Verify at binance.com/en/official-verification checks domains, email addresses, phone numbers and social handles, Telegram included. Binance says anyone who claims to work with Binance and cannot be confirmed there should be treated as untrusted.
• OKX has a channel verification page in its Help Center. OKX says to type the “@” before a username, or the result can be wrong.
• KuCoin runs an Official Verification Center at kucoin.com/cert. It checks emails, Telegram IDs, X accounts, websites and official wallet addresses.

Example. “Binance support” adds you on Telegram as @BinanceSupportDesk. You paste the handle into Binance Verify, and it comes back as not official. Block the account and report it.

Reach these tools by typing the exchange’s main address yourself and looking in its Help Center for “verify” or “official channel”. If the stranger sends you a link to a “checking tool”, that link is the trap.

A tool can confirm that an address belongs to the company. It cannot confirm that an email really came from that address, because the From line can be forged. Bybit’s own help page warns about this. For email, add check 5.

3. Ask them to message you from the company’s official X account

Ask the person to prove it on a channel only the company controls. Better still, contact that channel yourself. Here is a message you can send:

“Before I continue, please send me a DM from @ExampleExchange, the official account, confirming you work there and what this is about. Or I can DM that account and ask.”

A real employee will say “sure” or send you to the official support channel. A scammer will make excuses: “That account is for marketing only”, “our team can’t access it”, “this is confidential.” Each of those excuses means the person cannot prove it.

Make sure you have the right official account. Open it from a link on the company’s own website, since search results can show copycat accounts. It should have years of posts and the follower count you would expect.

Then look for X’s affiliate badge. Companies that pay X to verify their brand can link their staff accounts. An affiliated employee shows a small copy of the company’s profile picture next to their name, and tapping it opens the company’s account. A plain blue tick on a personal account says nothing about employment, because anyone can buy one.

Official accounts do get hacked. If the official account suddenly DMs you first with a link, treat that as suspicious too. Most companies never start private conversations about your account.

4. Ask for an email from the company domain, then read that domain letter by letter

A real employee can email you from a work address in a minute. Ask for it. A recruiter or “partner” who only uses Gmail, Outlook.com, Telegram or WhatsApp fails this test.

Then read the address slowly. Say the real company is Example Exchange at example.com. Each of these addresses is fake:

• support@examp1e.com (the digit 1 in place of the letter l)
• hr@exarnple.com ("rn" looks like "m" in many fonts)
• security@example-support.com (an extra word added to the name)
• team@example.co (the wrong ending)
• alerts@example.com.account-check.net (the real domain is account-check.net, read from the right)
• help@exаmple.com (the "а" is a Cyrillic letter that looks the same as the Latin one)

Two more things to check in the same email:

• The display name can say anything. “Example Exchange Security” might sit on top of x7k2@mail-ru.biz. Click or tap the name to see the real address.
• The Reply-To can differ. An email can arrive from an address that looks right and still send your reply to a stranger. Hit reply and look at the “To” field before you type.

A correct domain is a good start. On its own it can still be forged, which is why check 5 comes next.

5. Check the email’s sign-in results (SPF, DKIM and DMARC)

Every email carries test results that show whether it really came from the domain in the From line. Your inbox runs these tests already. You just have to look.

In Gmail, open the email, click the three dots and choose “Show original”. In Outlook, open the message, then More actions, View, “View message source”. In Apple Mail, choose View, Message, Raw Source.

Find the line that starts with Authentication-Results. A real email from example.com looks like this:

dkim=pass header.d=example.com; spf=pass smtp.mailfrom=example.com; dmarc=pass header.from=example.com

In plain words:

• SPF pass means the server that sent the email is on the domain’s approved list.
• DKIM pass means the email carries the domain’s digital signature, and nobody changed the message on the way.
• DMARC pass means at least one of those two tests passed for the same domain you see in the From line. This is the result to read first.

Warning signs: dmarc=fail, spf=fail, dkim=none, or a pass for some other domain, such as dkim=pass header.d=bulk-mailer-7.net on an email that claims to be from example.com.

Example. An email from “security@example.com” asks you to reset your password. Gmail’s “Show original” says dmarc=fail header.from=example.com. The From line is forged. Delete the email.

A DMARC pass means the email left a mail system the company approved. A hacked staff mailbox passes too, and forwarded emails sometimes fail SPF while being genuine. Treat the result as strong evidence and combine it with the other checks.

6. Paste the raw email into an AI chatbot and ask it to find the tricks

Raw email source is hard to read. A chatbot such as ChatGPT, Claude or Gemini can read it for you and point at the parts that look wrong.

1. Open “Show original” (or “View message source”) as in check 5 and copy everything.
2. Remove your own details first: your email address, name, phone number, account numbers and any codes. Replace each with “[removed]”.
3. Paste the text into the chatbot with a prompt like this one.

“Below is the raw source of an email, including headers and HTML. I think it may be a phishing email pretending to be from example.com. Please check: (1) Do SPF, DKIM and DMARC pass, and for which domain? (2) Does the From address match the Return-Path and Reply-To? (3) List every link in the HTML and show where it really points, compared with the text shown to me. (4) Are any domains lookalikes of example.com? (5) Anything else suspicious? Quote the exact lines you rely on.”

AI is good at this job. It will catch a link whose visible text says https://example.com/login while the code behind it points to https://example-com.login-verify.app, and it spots lookalike domains and hidden text far faster than most people do.

Example. You paste a “your withdrawal is on hold” email. The chatbot lists four links. Three go to example.com. The “Release funds” button goes to a domain nobody at the company owns, and that button is the scam.

Chatbots also make mistakes in both directions. An email that “looks fine” to a chatbot can still come from a hacked real account. Make it quote the lines it relies on, then check those lines yourself. Never paste passwords, seed phrases or one-time codes into any chatbot.

7. Hover over links and check when the domain was registered

Before you click anything, hover over the link on a computer, or press and hold it on a phone, to see the real address. Read the domain from the right, as in check 4.

Then look up when the domain was created. Paste it into the ICANN lookup and check the “Created” date. A company that has existed for ten years does not send security alerts from a domain registered last Tuesday.

Example. A “partnership manager” from a known crypto project emails from bd@exampleprotocol-team.com. ICANN lookup shows the domain was created nine days ago. The project's real site has used a different domain since 2021.

A brand-new domain is a strong warning sign. An old domain proves less, because some scam domains sit unused for months before they are used.

8. Check their LinkedIn the right way

A LinkedIn profile is easy to fake. A good fake still leaves gaps you can spot.

• Look for LinkedIn’s workplace check. LinkedIn lets members confirm their current employer, most often with a code sent to their work email, and the result shows on the profile. It confirms the company only. The job title is unchecked, and only some companies support it so far.
• Start from the company page. Open the company’s official LinkedIn page, go to its People tab and search for the name. Searching from the company side is harder to fool than clicking a profile someone sent you.
• Read the history. Real profiles usually have years of posts, a work history that makes sense, and connections who also work at the company. Fake ones are often new, with a few hundred random connections and a headshot that looks too perfect.
• Message the profile directly. Ask the LinkedIn account to confirm the chat you are having on Telegram or WhatsApp. Scammers often copy a real employee’s profile, and the real employee will reply confused.

A long history plus a workplace check is good evidence that the person exists and works there. It does not show that the person messaging you on another app is the same person, so always confirm on the profile itself.

9. Check the company’s team page, docs, GitHub and community admin lists

Many companies publish who speaks for them:

• The Team or About page on the official website.
• The docs or Help Center, which often list official support channels and say “we will never DM you first.”
• The GitHub organization. Open github.com/the-company and look at public members. A developer who says they work there can usually be found in that list.
• Telegram and Discord admin lists. Check the admin’s username, the part with the @, and ignore the display name. Anyone can set a display name to “Example Support | Admin”. OKX advises copying the username from the profile screen. If the “username” appears only in the bio, the account is probably fake.

Example. You post a question in a project’s Discord, and “Mod Alex” sends you a private message offering help. You check the server’s member list. The real Alex has a staff role and a different username. The account in your DMs joined the server yesterday.

Lists go stale when people leave, so when the stakes are high, confirm with check 1 as well.

10. Call back through the switchboard

If someone phones you from “the company”, hang up and call the number on the company’s website or on the back of your card. Ask to be put through to that person or department.

Example. “Your bank’s fraud team” calls and asks you to move savings to a “safe account”. You hang up and dial the number printed on your bank card. The bank has no record of the call. The FTC says bank impersonators caused the largest reported losses among business imposters in 2025, and these scams often end with victims persuaded to move money to “protect” it.

This check is hard to beat. Use another phone if you can, because some scams keep the line open after you hang up.

11. For crypto: ask for a signed message from a known wallet

Crypto has a check that nobody can fake without the private key. If a project or team member claims to control a wallet the project lists publicly, ask them to sign a message with it.

1. Find the wallet address yourself, in the project’s official docs, website or official X account.
2. Ask them to sign a message with today’s date and your name in it, such as: “I am Daniel from Example Protocol. Signed for Priya on 29 October 2026.” The date and your name stop them from reusing an old signature.
3. Check the signature on Etherscan’s Verified Signatures page. BaseScan, Arbiscan and other Ethereum-style explorers have the same tool. Enter the address, the message and the signature, and see whether it is valid.

A valid signature proves the signer controls that wallet. Whether the wallet belongs to the project depends on where you found the address, which is why step 1 matters.

12. Don’t treat a video call as proof

Plenty of people still treat a video call as the final word. Since 2024 that has been a costly habit. In January 2024, a finance employee at the Hong Kong office of engineering firm Arup joined a video call with what looked like the company’s CFO and other colleagues. Every other face on the call was a deepfake. The employee made 15 transfers worth HK$200 million, about $25.6 million, before checking with the head office, Hong Kong police said. Arup later confirmed to CNN that fake voices and images were used.

If a video call is part of the story, confirm through a second channel you found yourself: the company switchboard, the official X account or a work email you already confirmed with checks 4 and 5. Ask for a calendar invite sent from the company domain, and run check 5 on it.

13. Search their name, handle and domain with “scam”

Spend a minute on a web search:

• "@daniel_sec_team" scam
• "example-support.com"
• "Example Exchange" recruiter scam

Also look for the company’s own warnings. Many companies publish lists of fake domains and copycat tricks on their blog or Help Center.

If others have reported the same handle or domain, you know it is a scam within a minute. An empty search proves nothing, because a new scam has no reports yet.

Requests that end the conversation, whoever is asking

Some requests are scams however well the person passes these 13 checks, because a hacked real account can pass every test. Nothing makes these requests safe:

• Your seed phrase, recovery phrase or private key. No company ever needs it. Anyone who asks is stealing.
• Your password or a one-time code from SMS, email or an authenticator app.
• Remote access or screen sharing through AnyDesk, TeamViewer or a “support tool”.
• Moving money to a “safe” or “secure” wallet or account to protect it.
• Paying to receive money, such as a fee to unlock a withdrawal, a deposit to start a job, or “gas” to claim a prize.
• Installing software for a job interview. Fake crypto recruiters ask candidates to install a “video call app” or run a coding test that carries malware.
• Connecting your wallet to “verify” it, or signing a transaction you do not understand.

When you see one of these, stop. You don’t owe anyone a polite goodbye.

Three common scams, checked step by step

Scam 1: Fake exchange support on Telegram

The message. “@ExampleEx_Support” writes: “Your withdrawal is stuck. Connect your wallet at example-unlock.com to release it.”

The checks.

1. Check 2: the exchange’s checking tool says the handle is not official.
2. Check 7: ICANN lookup shows example-unlock.com was created this month.
3. The requests list: “connect your wallet to release funds” is on it.

Verdict. Scam. Block the account and report it to the exchange and to Telegram.

Scam 2: A recruiter from a crypto firm

The message. A LinkedIn profile titled “Senior Talent Partner at Example Labs” offers $180,000 for a remote developer role. The next step is a “technical test”: download a code repository and run it on your laptop.

The checks.

1. Check 4: you ask for an email from @examplelabs.com. The reply comes from a Gmail account, “because of internal policy”.
2. Check 8: nobody with that name appears on Example Labs’ LinkedIn People tab, and the profile is four months old.
3. Check 1: Example Labs’ careers page lists no such role.
4. The requests list: running unknown code from a stranger is on it.

Verdict. Scam. If you already ran the code, treat the laptop as compromised. Move any crypto to a new wallet created on a clean device, and change your passwords from that device.

Scam 3: A “partnership” email to a small project

The message. “Hi, I lead business development at Example Exchange. We’d like to list your token. Please sign the attached agreement and pay the $15,000 listing deposit.”

The checks.

1. Check 5: “Show original” says dmarc=pass header.from=example-exchange-listing.com. The email really came from that domain, and that domain belongs to someone else.
2. Check 3: you DM the exchange’s official X account. The exchange replies that it never asks for listing deposits by email and does not know this person.
3. Check 2: the exchange’s checking tool does not recognize the address.

Verdict. Scam. The email passed DMARC for its own lookalike domain, which is why reading the domain letter by letter (check 4) comes before the header check.

A checklist you can save

Before you share anything, pay anything or click anything:

• I found the company’s contact details myself. This person did not give them to me.
• I asked the company, through that channel, whether this person is real.
• I checked the handle or email in the company’s checking tool, if it has one.
• I read the email domain letter by letter, from the right.
• “Show original” shows dmarc=pass for the company's real domain.
• I checked where every link really goes, by hovering or with AI.
• The domain is more than a few months old.
• Their LinkedIn, team page or GitHub matches, and I searched from the company’s side.
• Nobody asked for a seed phrase, code, password, remote access, a fee or a software install.
• I am not rushing because someone told me to.

If any line fails, stop and confirm through a channel you found yourself.

If you already replied or paid

Act in this order:

1. Stop all contact. Do not send “one last” payment to unlock the first one. Fake “recovery” offers usually follow, often from the same crew.
2. Secure your accounts from a device you trust. Change passwords, reset two-factor authentication and log out of other sessions.
3. Move your crypto to a new wallet with a new seed phrase if you shared the old phrase or connected your wallet to a site. Revoke token approvals you do not recognize.
4. Tell the real company through its official support. The company can freeze accounts and warn other users.
5. Report it. In the US, use reportfraud.ftc.gov and the FBI’s ic3.gov. In the UK, use Report Fraud. Elsewhere, contact your national police cyber-crime unit.

FAQ

How can I verify if someone works for a company?

Contact the company through a channel you found yourself, such as its official website or official X account, and ask whether the person works there. Back that up with the company’s checking tool if it has one, a work email from the real domain that passes DMARC, and LinkedIn’s workplace check.

Can a verified X account be fake?

Yes. Anyone can buy a blue checkmark, and it says nothing about employment. On X, staff linked to a verified company show an affiliate badge, a small copy of the company’s logo next to their name. Official accounts can still be hacked, so pair the badge with a second check.

Is an email from the company’s domain always safe?

No. The From address can be forged, which is why you check for dmarc=pass in the raw headers. A real staff mailbox can also be hacked, and a hacked mailbox passes every check. If the email asks for anything on the requests list, treat it as a scam even when the headers pass.

Can AI tell me if an email is a scam?

AI is very good at reading raw email source and finding fake links, lookalike domains and failed SPF, DKIM or DMARC results. It still makes mistakes. Use it to point at the suspicious lines, check those lines yourself, and remove your personal details before you paste.

Will a real company ever message me first on Telegram or WhatsApp?

Most large crypto exchanges say their staff will not start private chats about your account and will never ask for funds, passwords or codes. Check the company’s Help Center for its own policy, and treat any unprompted private message as unconfirmed until you check it.

What is the safest way to check a recruiter?

Ask for an email from the company domain, find the role on the company’s own careers page, and search the recruiter’s name on the company’s LinkedIn People tab. Never pay a fee, buy equipment through the recruiter, or install software as part of an interview.

What should I do if someone fails these checks?

Stop replying, block the account, and report it to the real company and to the platform where you met. If you shared anything or sent money, follow the steps under “If you already replied or paid”.

Gaurav Agarwal writes about crypto security and on-chain investigations. If a scam message reached you that these checks did not cover, describe it in the comments, without personal details, and I will add a check for it.

How to Verify Someone Really Works for a Company: 13 Checks was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

A Florida county that discovered a clump of mysterious unpermitted Flock cameras during a countywide takedown effort won’t investigate who owned the sketchy cameras, which have since disappeared.

On Wednesday, The Washington Post reported that St. Lucie County residents "remain upset,” not knowing who installed the cameras or how they were using the data collected. Hannah Galindo, a 31-year-old resident who petitioned to get Flock cameras removed, told the Post that she was worried “that data could be anywhere.”

Of the 12 cameras found, five were eventually claimed by city law enforcement, the Post reported. Apparently, a police department mistakenly issued guidance claiming that officers could post multiple cameras under one permit, a Flock spokesperson told the Post, even though the county required individual permits. However, neither Flock nor the city police departments in Port St. Lucie and Fort Pierce that claimed the sketchy cameras will confirm who gave the guidance.

Read full article

Comments

Greece’s under-15 social media ban starts Jan. 1, 2027. Learn who is affected, how age checks will work, and what users should know about privacy.

The post Greece Passes Under-15 Social Media Ban Starting January appeared first on TechRepublic.

Greece’s under-15 social media ban starts Jan. 1, 2027. Learn who is affected, how age checks will work, and what users should know about privacy.

The post Greece Passes Under-15 Social Media Ban Starting January appeared first on TechRepublic.

Australia is preparing legal action against Meta, TikTok, Snap, and Google over alleged breaches of its under-16 social media ban. Here's what could happen next.

The post Australia Prepares to Sue Meta, TikTok Over Under-16 Social Media Ban appeared first on TechRepublic.

Australia is preparing legal action against Meta, TikTok, Snap, and Google over alleged breaches of its under-16 social media ban. Here's what could happen next.

The post Australia Prepares to Sue Meta, TikTok Over Under-16 Social Media Ban appeared first on TechRepublic.

The White House AI task force has begun a 120-day review of cybersecurity, biosecurity and oversight, with potential implications for businesses and developers.

The post White House Begins 120-Day AI Safety Review Amid Growing Security Concerns appeared first on TechRepublic.

The White House AI task force has begun a 120-day review of cybersecurity, biosecurity and oversight, with potential implications for businesses and developers.

The post White House Begins 120-Day AI Safety Review Amid Growing Security Concerns appeared first on TechRepublic.

Anthropic has granted external evaluators “employee-like access” to assess the risks of its models, following through on a commitment to increase safeguards over concerns the technology could run catastrophically out of control.

METR, a nonprofit that has worked with leading labs including OpenAI, Anthropic, Google, and Meta, now has a team embedded in the Claude maker’s office with access to its hardware and internal systems.

A greater role for third-party evaluators is among the main concrete steps the labs have proposed in response to rising concern about the dangers more capable AI systems could pose to the economy, cyber security, and humanity at large.

Read full article

Comments

The FTC has subpoenaed OpenAI and Anthropic over potential consumer protection violations. An AI security expert explains the risks of enterprise AI agents.

The post FTC Demands Answers From OpenAI and Anthropic About AI Safety appeared first on TechRepublic.

The FTC has subpoenaed OpenAI and Anthropic over potential consumer protection violations. An AI security expert explains the risks of enterprise AI agents.

The post FTC Demands Answers From OpenAI and Anthropic About AI Safety appeared first on TechRepublic.

Safety researchers continue to warn that a large volume of AI-generated explicit content is spreading unchecked, while regulators do little to meaningfully stop it.

This non-consensual content is commonly shared in text and direct messages or stored in private clouds where it’s less likely to be detected or reported, a Google co-authored study of Internet users across the United States, Australia, and the United Kingdom found this July. That’s why the “most critical intervention point” remains at the source: the harmful AI tools used to make the fake sexual images, Google researchers concluded.

Yet red-teaming in recent months suggests that as some of the leading AI image generators from Google and OpenAI become more capable, they may be getting worse at blocking explicit outputs.

Read full article

Comments

Seattle embraced the global spotlight and rode a wave of economic euphoria when the FIFA World Cup came to town this summer, but according to new voter data out Tuesday, the city let that momentum slip away just as downtown businesses and major tech employers grapple with an ongoing economic squeeze.

The eleventh edition of The Index, a semiannual survey tracking voter sentiment commissioned by the Seattle Metropolitan Chamber of Commerce, reveals a sharp erosion in public confidence regarding the city’s economic trajectory.

According to polling of 700 Seattle voters conducted from Sept. 23 to Oct. 1 by public opinion research firm Fulcrum Strategic Group, 68% believe the city’s economy is getting weaker, 22% think it’s staying the same, and just 10% say it’s stronger.

While voters point to persistent quality-of-life concerns like public safety, homelessness and affordability, the findings underscore growing anxiety over Seattle’s business climate, at a time when major tech employers continue to evaluate their regional footprint and shift jobs across Lake Washington.

Seattle Metro Chamber President and CEO Joe Nguyen said the World Cup brought an energy and excitement downtown that was real and positive. But after a few months, there’s been no sustained honeymoon, and 65% of voters feel Seattle is losing positive momentum on public safety and quality of life.

“We demonstrated as a region what is possible when we all work together, and folks are already feeling that shift away,” Nguyen said during a media briefing Tuesday.

While chief concerns in the survey center on crime and public safety, economic health follows closely behind. In addition to widespread pessimism about the city’s overall trajectory, 71% of respondents agree that businesses are closing down or leaving for nearby cities because the cost of doing business in Seattle has gotten too high. Furthermore, 95% of those surveyed say it is difficult for small businesses to operate in the city.

When it comes to major employers — the tech giants and large corporations such as Amazon that anchor the regional economy and bear the brunt of taxes like the city’s JumpStart payroll levy — the survey reveals a striking disconnect.

The survey found 70% of voters recognize large businesses as essential to Seattle’s success, defying the narrative that the local electorate is anti-business. Andrew Thibault, partner at survey conductor Fulcrum Strategic Group, called it “the most interesting section” in the whole survey.

“Voters here deeply understand that their quality of life is connected to the health of the business environment and our ability to afford the things that we want to afford, like transit and schools, and environmental protections,” Thibault said. “All of those depend on a healthy business environment.”

But a significant knowledge gap persists around tax contributions. Voters estimated on average that large businesses pay just 37% of the city’s total tax revenue, with three-quarters believing that figure sits below 50%. In actuality, businesses pay 68% — more than two-thirds — of all city taxes, according to a recent tax analysis from the Chamber.

Underlying economic anxiety is playing out directly in City Hall’s budget debates. As major employers and tech giants navigate a shifting economic landscape — including recent reports showing downtown Seattle shedding 13,000 jobs in a single year while neighboring Bellevue’s tech hub expanded — voters are demanding a tighter rein on city spending.

The Index reveals that 66% of Seattle voters distrust the city to spend tax dollars responsibly, and nearly eight in 10 support requiring City Hall to prove existing spending is producing results before asking residents or major employers to pay more.

Those sentiments carry heavy weight as the city grapples with its budget. Facing what officials call “seismic shifts” in the tech sector, Mayor Katie Wilson’s proposed budget attempts to close a massive deficit through spending cuts while freezing the rates for corporate levies like the JumpStart payroll tax.

For Nguyen and the Chamber, the message from voters is clear: City Hall must focus on tangible delivery with existing resources rather than continuous policy shifts and progressive tax increases.

Pointing to the city’s reliance on core revenue streams like business and occupation (B&O), sales, and JumpStart taxes, Nguyen emphasized the risk of over-targeting a concentrated corporate base.

“Finagling with it too much creates a problem where the people who are reliant upon paying the taxes are also the ones being targeted,” Nguyen said. “So if they leave, it creates a multiplier effect in the wrong direction.”

Regular readers of this column may have wondered about the long gap since my Sept. 4 column, “What kids tell chatbots, but not you.” Well, it’s hard to write business-as-usual AI columns during the great AI freakout. I’ve realized that I won’t be able to do justice to this topic in one column, and that life goes on. As the economist Antoine Levy pointed out, OpenAI employees warn that we may all die within a few years yet still fund their 401(k) accounts.

I’m easing into the topic of AI risks by sharing a recent debate I had with Max Tegmark, an MIT professor and a leading AI doomer. The New York Post set this up as optimist against doomer, but I consider myself an AI realist.

Tegmark noted that Bernie Sanders and Steve Bannon have converged on AI, and took it as good news. It terrified me. AI needs rules written by people who understand it, not by demagogues. Tegmark said that AI is less regulated than a sandwich shop, but we have plenty of sandwich shops and zero superintelligence (so far). I believe that we should address what exists: the hackers who already use AI to break into companies for the price of lunch.

A condensed version of the debate follows. Words in quotation marks are verbatim, and the rest is paraphrased. You can view the debate on YouTube. Several exchanges refer to this summer’s incident, in which OpenAI test agents got out of their sandbox and hacked Hugging Face.

Six points of disagreement

1. Is AI already out of control?

Tegmark: Loss of control used to be a forecast, and “now suddenly it’s in the past.” This summer “1,200 rogue bots broke out of this American company,” and “humans didn’t even find out until weeks later.”

Etzioni: The agents weren’t rogue. The people “setting the configurations of their sandbox” at OpenAI “failed to put the boundaries on them appropriately.” People made that mistake, and people can fix it.

2. Today’s dangers vs. extinction risks

Etzioni: Cyberattacks and attempts to make bioweapons are “a clear and present danger.” Extinction-level risks are different: “We haven’t seen those yet. We hypothesize, and usually pretty vaguely, on how these will come about.”

Tegmark: The risks Etzioni wants to separate are “connected in their cause.” “If there were some safety standards like there are for other industries, so many of these problems would go away.”

3. Government regulations vs. technical fixes

Tegmark: Do what the auto and pharma industries do, and “have some binding safety standards that the government requires before people can make money off of products.” Companies would have to show that their AI won’t harm kids and won’t slip out of their control. If they can’t show that terrorists won’t use it to make bioweapons, “well, come back when you can, buddy.”

Etzioni: Regulation is necessary, but it has its own risks. “The road to regulatory hell is paved with the EU’s good intentions.” And “we should not underestimate the power of technical solutions.” The author Dan Wang says China is run by engineers and America is run by lawyers, so we naturally talk about regulation and they naturally talk about technical fixes. For bioweapons, the fix may lie “in the transitions from what’s called bits to atoms,” where we can block the physical materials an attacker needs.

4. Can we count on China?

Tegmark: “We don’t have to trust China.” The Chinese Communist Party wants to stay in control, so “they will not want to let a Chinese company build uncontrollable superintelligence.”

Etzioni: I don’t trust China. “Nothing would make them happier than us hamstringing ourselves.”

5. Is the political backlash good news?

Tegmark: “There’s been more political change in a good direction in the last few months than in the past decade.” It’s like a ketchup bottle: “nothing, nothing, nothing, and then all of it at once.” At my convention I introduced Bernie Sanders and Steve Bannon back to back, “which had not been in my bingo card.”

Etzioni: “Can you imagine two worse demagogues?” And “we need to have good solutions, not popular ones.”

6. How it plays out

Etzioni: “I foresee over time something quite negative happening, and to me the question is whether it’s Hiroshima or the Cuban Missile Crisis.” The Cuban Missile Crisis was a threat averted. Hiroshima was a catastrophe that came before the better rules did.

Tegmark: Self-interest is the fix. Make safety the way companies get rich, and “we’re going to see all the creativity and entrepreneurship of private industry racing to the top to do this instead of racing to the bottom.”

Five points of agreement

1. Don’t take AI CEOs at their word

Etzioni: The AI CEOs are self-interested. “When you are on the path to a trillion-dollar-plus IPO, that exerts a gravitational force on your mind.”

Tegmark: “I completely agree with Oren that we need to take what the AI CEOs say with a grain of salt.” Listen to AI pioneers Geoffrey Hinton and Yoshua Bengio instead: “I don’t think we can dismiss them as just doing it for some money reasons.” The whistleblowers gave up stock options potentially worth $1 million or more to speak out.

2. We were both wrong

Etzioni: I was an AI optimist and I’m now an AI realist. The things I thought were many years away “are either right here, right now, or coming soon at a pace that we may not be able to anticipate.” I’ve learned from Tegmark, and “I was wrong.”

Tegmark: I was wrong too. “I never imagined that the people in America with the most power would let companies get so close to things that one could lose control over without intervening.”

3. Self-regulation won’t work

Tegmark: “The idea of corporate self-regulation is a joke in this case.” It “didn’t work out so well for the tobacco industry or for the pharma industry.”

Etzioni: I agree. Social media showed us how self-regulation goes: “This is the big tobacco moment for high tech.” “We don’t want to spend another 20 years to find out that AI companies didn’t exercise the appropriate level of self-discipline.”

4. Box AI systems in

Etzioni: A self-driving car will save your life, but “it doesn’t decide where to go. That’s a completely different system in the car than the thing that controls the brakes.” When I tell my car to head to Dunkin’ Donuts, the car doesn’t respond that it’s taking me to the gym instead because “it’s the second time you’ve gone to Dunkin’ Donuts this week.” We should box in other AI systems the same way.

Tegmark: “By default, machines should be given the least amount of access and power that they need to do their job.” “You don’t give every janitor in the Pentagon the nuclear codes.”

5. The time to act is now

Etzioni: “We agree on off switches for AI. I’ve been advocating that since at least 2017. We agree on labeling, on liability, on cyber standards, protecting kids.” The time to do that work is now.

Tegmark: “I agree with Oren: the time to actually act on this is now.”

Postscript: The real difference

Look back at these disagreements. Where Tegmark blames the machine, I blame a person. An engineer left a hole in the sandbox. A hacker typed the prompt. A politician found a new fear to run on. That’s why I’d box AI systems in rather than count on how they were raised.

Anthropic’s Amanda Askell compared getting Claude to behave to raising a child. But those of us with kids know how that goes. As I said in the debate, “the three-year-olds don’t listen to us, but the teenagers certainly don’t listen to us.”

Ring is moving from the doorbell to the deadbolt.

The Amazon-owned company on Wednesday announced its first smart lock, a $249 deadbolt with no keyhole and a dial that recharges a dead battery by hand.

Jamie Siminoff, Ring’s founder and chief inventor, said the dial solves the problem that has kept smart locks from catching on the way video doorbells have: when the battery dies, the owner can be locked out. That’s why many smart locks still come with a key.

“If you have to have a key, it’s like, well, why have a smart lock?” Siminoff said in an interview before the announcement.

Twisting the dial somewhere around five to 10 times (depending on how far and how fast it’s turned), generates enough power to turn the lock back on. The light turns green when it’s ready, and the owner can then get in with a fingerprint, the keypad or the Ring app.

Other smart locks offer backups such as terminals for a 9-volt battery or a USB-C port. Those don’t help someone standing at the door at 1 a.m. without a battery or a cable, Siminoff pointed out.

The Ring Smart Lock is due to ship in the first quarter of next year. It runs on a standard Ring battery pack that should last about a year, Siminoff said, and none of its features requires a subscription.

It connects through Amazon Sidewalk, a shared network powered by nearby Amazon devices, and works with Alexa for voice commands and connections to other smart home devices.

The landscape: Ring is entering a market that includes established lock makers such as Schlage, Yale and Aqara. Apple is also preparing its own smart home push, which will include a smart deadbolt lock, video doorbell and security cameras developed with LG Electronics and sold under the LG brand, Bloomberg reported Tuesday.

Apple plans to introduce its own smart home devices Oct. 13, and the LG products aren’t expected to reach consumers for at least a few more months, according to the report. The LG lock supports ultra-wideband, a technology that lets a door unlock automatically as its owner approaches, Bloomberg reported.

Why Ring waited: Siminoff’s first video doorbell, the Doorbot, went on sale in 2013 in a bundle with a smart lock from another company, he said. Ring has since integrated its products with other companies’ locks.

Ring could have put its name on a lock and sold plenty of them, Siminoff said, but he didn’t think the company belonged in the business until it had something different to offer.

The parts inside the new lock are mostly off the shelf, he said, including the components that generate power. The invention was putting them together, and Siminoff said he’s annoyed with himself for not doing it years ago.

“I literally can’t believe that I just didn’t look at this and just fix the damn thing,” he said.

Siminoff, who returned to lead Ring last year, said he worked out the idea on his own computer at night using Amazon’s AI tools, estimating the number of cranks, the cost and whether the parts would fit before handing it to Ring’s engineers. A few years ago, he said, answering those questions would have taken five to 10 engineers and six months.

Privacy and the front door: The lock arrives after a difficult stretch for Ring on privacy. A Super Bowl ad in February for Search Party, a feature that uses AI to scan footage from neighbors’ outdoor cameras for lost dogs, drew a backlash from critics who asked what would stop the same technology from being used to find people.

Days later, Ring canceled a planned partnership with Flock Safety, the license-plate-recognition company, that would have let police using Flock’s platform request video from Ring users. Ring said at the time that the integration never launched and no customer videos were shared.

Asked what he would say to customers wary of giving Ring control of the door itself, Siminoff pointed to Throw Away the Key Encryption, or TAKE, which Ring started rolling out in September and says will become its default. Ring deletes its copies of the encryption keys, the digital codes needed to view customers’ videos, after using them, leaving the keys on customers’ own devices.

“You do not need to compromise on privacy in order to have security,” he said.

At launch, the lock and Ring’s cameras will work together in limited ways. The lock’s activity will show up in the Ring app alongside the company’s doorbells, cameras and alarms, and an owner who sees a visitor on a doorbell camera can unlock the door from the app.

The lock won’t open on its own when a Ring camera recognizes a face. Siminoff said deeper connections between the lock and the cameras haven’t been built, and Ring wants to take the time to get them right.

The lock has no camera of its own. “I think the lock should be a lock and should stay a lock,” he said.

He was also cautious about Amazon delivery drivers using the lock to leave packages inside. Garage delivery is a growing business for the company, he said, calling the garage “the airlock,” a semi-public space between the outside world and the fully private house.

“I still don’t see a world at scale where people are entering homes without the homeowner there,” he said. “It’s not a technology thing. It’s a human thing.”

Ring will expand to other types of locks and other countries if the deadbolt sells, Siminoff said, and tie the lock more closely to its doorbells. He said he’d take on other parts of the door, even the hinge, if he found a way to improve them.

“I never thought we’d do a lock,” he said. “I really didn’t.”

New cameras: Ring also announced five new cameras. Four add to its 4K lineup: the Outdoor Cam 4K Plus ($149.99), Spotlight Cam 4K Plus ($199.99), Floodlight Cam 4K Plus ($219.99) and Indoor Cam 4K ($99.99), the first indoor model in the line. The fifth, the $69.99 Pan-Tilt Indoor Cam 2K, rotates 360 degrees to follow motion.

The two indoor cameras go on sale Wednesday in the U.S., and the three outdoor models are available for preorder.

Bellevue, Wash.-based Temporal is expanding its security capabilities for AI agents following a $550 million funding round last month that valued the enterprise infrastructure company at $12.55 billion.

In an announcement Tuesday, Temporal revealed that team members from Oso, a New York-based startup specializing in application authorization, are joining the company to integrate access controls directly into Temporal’s platform. Meanwhile, holding company Tiny acquired Oso’s software product and customer base.

The move addresses a growing challenge for enterprise tech teams: while generative AI models handle reasoning, autonomous agents must interact with internal databases, execute multi-step workflows, and call external application programming interfaces without breaching security boundaries.

“AI safety doesn’t stop at the model,” Temporal VP of product Preeti Somal said in the release. “It extends into the applications where agents act, which is where access to systems and crucial data comes into play.”

Temporal’s primary technology, known as “durable execution,” maintains application state and execution history across system failures and network timeouts. By adding Oso’s security frameworks to this underlying engine, Temporal aims to ensure an agent’s permissions and human approvals remain intact, preventing agents from bypassing controls or repeating rejected actions.

Temporal said the addition of the Oso team will accelerate security features currently in development, with existing platform operations remaining unchanged.

“Our goal is practical: to help developers put agents to work with appropriate access and with guardrails their companies control,” said Somal. “In practice, that means asking, for each action an agent takes, who it is acting for and what that person is allowed to do, and getting the same answer every time the work is retried.”

In a press release, Oso founder Graham Neray said:

“What makes agents valuable is the same thing that makes them dangerous – access to real systems and data. Temporal already powers agents in applications like Cursor and OpenAI Codex, and unlocking their full potential requires the right security controls. We’re joining Temporal to accelerate its work on agent authorization, giving developers more precise control over what agents can access and do.”

Co-founded in 2019 by Amazon and Microsoft veterans Samar Abbas and Maxim Fateev, Temporal provides open-source orchestration tools used by companies including OpenAI, NVIDIA, Netflix, Snap and JPMorgan Chase. The company recently surpassed $250 million in annualized revenue run rate, growing more than 200% year-over-year.

It employed about 570 people prior to the Oso deal, roughly double from a year ago, with 89 in the Seattle area. The company is fully remote. Its Bellevue office, previously occupied by OpenAI, is used mainly for meetings rather than daily work. The company recently rose to the #1 spot on the GeekWire 200, the list of the fast-growing privately-held tech startups in the Pacific Northwest.