17 OctThe Daily FiveSaturday

KYC caller names arrive, an APK factory gets busted, and ChatGPT ads get personal

India switches on KYC caller names from November 1, and Mumbai police arrest a man accused of supplying 2,805 scam APKs. Plus Bank of America's AI bug bill, the ChatGPT ad setting to change today, and why ChatGPT's ad targeting looks very familiar.

  1. Long Press · Daily Five17 Oct 202601 / 05
    Illustration for the story: From November 1, unknown calls in India show a KYC name
    commentaryIndia

    From November 1, unknown calls in India show a KYC name

    The Department of Telecommunications has told every Indian telecom operator to switch on caller name display, called CNAP, across the country from November 1, 2026, Deccan Herald reports. Incoming calls will show the name on the caller's KYC records, free, and business callers have to show their GST or trademark name. It's the right fix, arriving about four years after TRAI first floated it in 2022, years we spent trusting a crowd-sourced app to tell us who was calling. It won't end scam calls, because plenty of fraud runs on SIMs with someone else's real name attached, but it makes 'I'm calling from your bank' a lot harder to say with a straight face.

    The question

    When will caller name display (CNAP) start in India?

    In one line

    The Department of Telecommunications has ordered all Indian telecom operators to switch on caller name display, called CNAP, nationwide from November 1, 2026. Incoming calls will show the caller's KYC-registered name for free. People who opted for Calling Line Identification Restriction stay hidden.

    The problem

    Indians get a steady flood of calls from numbers they don't know, and the only way to guess who's on the line has been a third-party app built on whatever names other users happened to save. Scammers live in that gap.

    What changed

    From November 1, 2026, the DoT wants every operator to show the KYC-verified name of the caller on incoming calls, pulled from dedicated operator databases, at no charge, per Deccan Herald. Telemarketers must show the name registered with GST or the Trade Marks Registry, international calls get an 'International' tag, and anyone who chose Calling Line Identification Restriction stays hidden.

    The catch

    A KYC name is only as honest as the KYC behind it. The order also doesn't spell out which phones or networks will show names on day one.

    What it means for you

    From November, treat the name on screen as a hint, not proof. A call tagged International that claims to be your bank, or a name that doesn't match the company it says it is, is your cue to hang up and call back on the official number.

    Questions people ask

    Will CNAP caller name display replace Truecaller in India?

    Partly. CNAP shows the name tied to the SIM's KYC records, pulled from operator databases, so it is harder to fake than the crowd-sourced names in third-party apps. It doesn't promise spam scores or community reports, so a spam-blocking app still adds something for now.

    What name will business and telemarketing calls show under CNAP?

    Telemarketers must display the name registered with GST or the Trade Marks Registry, so a sales call should show the company rather than a random person's name. International calls get an 'International' tag, which helps because a call claiming to be your local bank shouldn't be coming from overseas.

    Does CNAP caller name display cost extra on Indian mobile networks?

    No. The DoT order says the name display is free for users. The Deccan Herald report doesn't say which handsets or network types will show names on day one, so don't be surprised if an older phone takes longer to start showing them after November 1, 2026.

    SourcesDeccan Herald ↗

  2. Long Press · Daily Five17 Oct 202602 / 05
    Illustration for the story: Bank of America hired 1,000 people to fix bugs AI found
    security

    Bank of America hired 1,000 people to fix bugs AI found

    Bank of America added about 1,000 contractors in the second quarter just to patch software flaws that AI models, Anthropic's Mythos among them, found in its own and its vendors' code, CEO Brian Moynihan told CNBC. It's the most concrete picture yet of what AI bug-hunting costs the people on defence. Finding the bug is the cheap part now. Fixing it, testing the fix and shipping it across a giant bank's systems and every vendor it depends on is still slow, human work, and apparently a thousand extra humans' worth of it.

    The question

    Why did Bank of America hire 1,000 contractors to fix software flaws?

    In one line

    Bank of America added about 1,000 contractors in the second quarter of 2026 to patch vulnerabilities that advanced AI models, including Anthropic's Mythos, found in its own and its vendors' software. CEO Brian Moynihan disclosed it to CNBC on October 14, 2026. No Mythos-only cost was given.

    The problem

    Big banks run on decades of in-house code plus a long tail of vendor software, and nobody has ever had a complete list of what's broken in it. That backlog stayed hidden mostly because finding bugs used to be slow.

    What changed

    Moynihan told CNBC on October 14 that the bank brought in roughly 1,000 contractors in Q2 2026 to fix vulnerabilities surfaced by advanced models including Mythos, across internal and vendor software. RuntimeWire notes the extra spending the bank reported mixes this with anti-money-laundering costs.

    The catch

    There's no Mythos-only bill, and the bank hasn't said how many flaws were found or how serious they were. So treat it as a headcount signal rather than a scorecard.

    What it means for you

    If you build or buy software, expect 'we'll patch it next quarter' to stop being an acceptable answer. Your bank and the apps it plugs into are getting fixed faster, which is good, and attackers have the same tools, which is why it's happening.

    Questions people ask

    Why are bank CEOs worried about Anthropic's Mythos AI model?

    Mythos is one of the advanced models now surfacing software flaws faster than security teams can fix them by hand. Bank of America's Brian Moynihan has joined other Wall Street bosses warning about its risks, because any bug a defender's model can find, an attacker with similar tools can find as well.

    How much is Bank of America spending to fix AI-found software flaws?

    There isn't a clean number. Reporting says the extra spending the bank disclosed lumps the Mythos-driven patching together with anti-money-laundering work, so it isn't the cost of AI-found bugs on their own. The clearest figure is headcount: roughly 1,000 contractors added in a single quarter to patch internal and vendor code.

  3. Long Press · Daily Five17 Oct 202603 / 05
    Illustration for the story: One ChatGPT setting stops your old chats picking your ads
    tip

    One ChatGPT setting stops your old chats picking your ads

    If you use ChatGPT on the Free or Go plan, open Settings, then Ad Controls, and switch off Personalize ads, per OpenAI's help page. From then on, ads are picked only from the chat you're in, not your history. Switch off Past chats and memory while you're there, then tap Delete ads data. It takes two minutes, and that three-month-old conversation about your loan EMIs stops deciding what you get sold.

    The question

    How do I turn off personalized ads in ChatGPT?

    In one line

    Open ChatGPT Settings, go to Ad Controls and switch off Personalize ads. Ads will then use only the chat you're in. You can also switch off Past chats and memory, then tap Delete ads data. Ads show on the Free and Go plans, including in India since August 2026.

    The problem

    ChatGPT started showing ads to Free and Go users in India in August, per Business Today, and with personalization on, your past chats and memory can feed which ads you see. Most people never open the setting.

    What changed

    Settings, Ad Controls has three things worth touching: Personalize ads (off means only the current chat counts), Past chats and memory (off keeps your history out of ad selection), and Delete ads data, which OpenAI says stops use immediately and clears its servers within 30 days.

    The catch

    None of this makes ChatGPT ad-free, and Gizmodo notes the toggle may not block advertisers who match you through an uploaded list of emails or phone numbers. Only a paid plan like Plus drops ads entirely.

    What it means for you

    If you're on Free or Go and you've ever talked money, health or work problems through with ChatGPT, change this today.

    Questions people ask

    Which ChatGPT plans show ads in India?

    Ads may appear on ChatGPT's Free and Go plans. Plus, Pro, Business, Enterprise and Edu accounts don't get ads, and neither do accounts identified as under 18. ChatGPT ads started showing to Free and Go users in India in late August 2026, so most Indian users are in scope.

    Does turning off personalized ads in ChatGPT stop all ad targeting?

    No. With Personalize ads off, ads still draw on the chat you're currently in. Gizmodo also notes the setting may not stop advertisers matching you through an uploaded list of emails or phone numbers. What it does cut out is your past chats, memory and ad history.

    How long does Delete ads data take to work in ChatGPT?

    OpenAI says deleted ads data stops being used for ads right away, while full removal from its servers can take up to 30 days. It's a one-tap clean slate and worth doing once, straight after you switch Personalize ads off, so old activity doesn't keep shaping what you see.

  4. Long Press · Daily Five17 Oct 202604 / 05
    Illustration for the story: That APK on WhatsApp isn't an invitation. It's a key
    myth busterIndia

    That APK on WhatsApp isn't an invitation. It's a key

    Mumbai Crime Branch has arrested an Indore graphic designer accused of building and supplying 2,805 malicious APK files to fraud networks that took about Rs 150 crore from victims across India, Deccan Herald reported on October 15. One person, thousands of fake apps. That tells you the 'bank update' or 'wedding card' APK in your family group isn't some clever one-off, it's a product line. The myth that keeps it working is that a file from a known contact must be safe, when the contact's phone is usually the first thing that got hacked.

    The question

    Is it safe to install an APK file sent on WhatsApp in India?

    In one line

    No. On October 15, 2026, it was reported that Mumbai Crime Branch arrested an Indore designer accused of supplying 2,805 malicious APK files to fraud networks that cheated victims across India of about Rs 150 crore. Install apps only from the Play Store, even when a contact sends the file.

    The problem

    Fake bank, challan and invitation apps keep landing in Indian WhatsApp and Telegram chats, and people install them because the sender is a cousin or a colleague. That trust is the entire attack.

    What changed

    Police say Pankaj Gupta, a graphic designer from Indore, made and supplied 2,805 malicious APKs to cybercriminal networks that cheated victims of roughly Rs 150 crore, according to Deccan Herald. The Property Cell of the Mumbai Crime Branch made the arrest, and the case is tied to fake government apps and remote-control malware.

    The catch

    These are police allegations, and nothing has been proven in court yet. The report doesn't say how many people were hit either, which, given 2,805 apps, is probably a number nobody wants to say out loud.

    What it means for you

    Keep Install unknown apps switched off for WhatsApp, Chrome and your file manager, install only from the Play Store, and never give a new app Accessibility or screen-control permission. If money moves, call 1930 straight away.

    Questions people ask

    Who supplied the 2,805 malicious APKs in the Rs 150 crore fraud case?

    The Property Cell of the Mumbai Crime Branch arrested Pankaj Gupta, a graphic designer from Indore, accused of creating and supplying 2,805 malicious APK files to cyber-fraud networks. Police say those networks cheated victims across India of about Rs 150 crore. Deccan Herald reported the arrest on October 15, 2026.

    What kinds of fake APKs are used in Indian cyber fraud?

    The Deccan Herald report on the Rs 150 crore case links the files to fake government apps, fake cyber portals and remote-control malware, alongside digital arrest and fake challan schemes. They usually arrive in chats dressed up as something urgent or friendly, which is why the sender's name means very little.

    SourcesDeccan Herald ↗

  5. Long Press · Daily Five17 Oct 202605 / 05
    Illustration for the story: ChatGPT's ads know your phone number. That should bother you
    hot take

    ChatGPT's ads know your phone number. That should bother you

    Advertisers can target ChatGPT users by uploading lists of emails, phone numbers and Android ad IDs, which OpenAI matches against accounts, 404 Media found by running its own test campaigns. Gizmodo adds that a list needs at least 25,000 entries. My problem isn't ads in a free product. It's that people tell ChatGPT things they would never type into a search bar, and now the same customer-list machinery that made social media ads feel creepy sits right next to those conversations. OpenAI pitched a different kind of ad business, and this looks like the old one with a nicer chat window.

    The question

    Can advertisers target ChatGPT users by email or phone number?

    In one line

    Yes. 404 Media reported on October 15, 2026 that advertisers can target ChatGPT users by uploading lists of email addresses, phone numbers or Android advertising IDs, which OpenAI matches to accounts. Ads can also draw on what you type. It's the old social-media ad playbook, now inside a chatbot.

    The problem

    ChatGPT has roughly a billion monthly users, and plenty of them treat it like a diary, a doctor and a finance advisor rolled into one. OpenAI's promise was that ads would stay politely apart from all that.

    What changed

    By running two campaigns, 404 Media showed advertisers can reach users by email, phone number or Android advertising ID, matched by OpenAI to ChatGPT accounts, on top of targeting based on prompts. Per Gizmodo, audiences need at least 25,000 entries, the data can be raw or hashed, and OpenAI says uploaded files are deleted within 24 hours.

    The catch

    OpenAI says advertisers never see your chats or learn when a list entry matches, and being on a list doesn't guarantee you an ad. That's fair, and it's also what every ad platform says.

    What it means for you

    On Free or Go, switch off Personalize ads in Settings, Ad Controls, knowing it may not stop list matching. If you use ChatGPT for anything sensitive, it's worth asking whether free is really the price.

    Questions people ask

    Does OpenAI share my ChatGPT chats with advertisers?

    OpenAI says advertisers never receive your chats, memories or personal details. But per Gizmodo, an advertiser can upload a list of at least 25,000 emails, phone numbers or device IDs, and OpenAI checks which match ChatGPT accounts. OpenAI says it deletes those uploaded files within 24 hours of processing.

    Can I stop advertisers targeting me on ChatGPT by email?

    Not completely on the Free or Go plans. Switching off Personalize ads in Settings, Ad Controls keeps past chats and memory out of ad selection, but Gizmodo notes it may not block list-based matching. Paid plans such as Plus don't show ads at all, which is the only clean way out.

Taps

Quick hits. One line each, for when a long press is too much.

  • India

    NPCI pushes the UPI merchant charge on payments above Rs 2,000 to after Diwali

    It was due October 15. Person-to-person UPI stays free and about 96% of merchant payments are unaffected, per News On AIR.

    News On AIR ↗
  • India

    DRDO tests quantum key distribution on a live defence network in Odisha

    The Chandipur trial secures weapons-test telemetry. It doesn't make all military communication quantum-safe yet, per Swarajya.

    Swarajya ↗
  • Global

    Eight US states sue OpenAI over ChatGPT's risks to children

    Arkansas also wants testing of advanced models halted until safeguards exist, per Engadget.

    Engadget ↗
  • Global

    Microsoft's 2.8 trillion parameter MAI-Base-2 won't be open-sourced

    80B active, trained on 16,000 GB200s in 38 days. Weights go to trusted partners through Foundry, per Microsoft AI.

    Microsoft AI ↗
  • Global

    OpenAI and Meta tell US judges no detector will catch every deepfake

    Courts shouldn't wait for a universal AI checker to authenticate evidence, the companies told a federal judicial panel, per Reuters.

    Reuters ↗
That's all five. Next edition tomorrow.Press and hold