SearchSubscribe

BriefingRules & costs

The week in digital: card fees revealed, hijacked TV boxes and a fee to text

The first card fee data, 1.3 million hijacked Android TV boxes, Apple’s check on public iCloud links, one AI training opt-out and a proposed sender ID fee.

By Digital Advisors Publisher Bob Jones 4 min read 16 sources

a halftone woman in her sixties in a sun hat sitting on a bench at a suburban Australian bus stop, reading a large halftone folded broadsheet newspaper held open in both hands, a halftone shopping trolley bag beside her and a halftone kelpie dog lying at her feet, on a flat saturated orange background. the newspaper's masthead is the only full-colour element, a bright cobalt blue banner across the top of the front page with THIS WEEK in bold white capitals; these are the only readable words
Illustration: Digital Advisors

This week you got your first real look at what banks charge to take cards. More than a million Android TV boxes turned out to have a backdoor built in. Apple said it will check anything you share by public iCloud link. Google and Bing backed one way to say no to AI training, and the ACMA wants to charge for texting under your business name. Here are five stories worth taking into next week.

1. What banks charge to take cards, at last

For the first time, the big card providers have published their average merchant service fees. Across all direct merchants for July to September, NAB averaged 0.58%, and Westpac and ANZ Worldline 0.55%. Square averaged 1.34%.

Small merchants paid more. Among the banks, that ranged from 0.79% at Westpac to 0.97% at ANZ Worldline, and Square charged them 1.47%. Small means taking $1 million or less a year on cards with that provider. Online and keyed-in payments cost small merchants more than a tap in store at all four providers.

So what: work out your own rate from last quarter’s statements and compare it with your provider’s small or medium-sized merchant figure. The next figures, due by 30 January 2027, will be the first after the October fee cuts.

See the full tables.

2. A backdoor in 1.3 million Android TV boxes

Google and industry partners have dismantled XCPE, a backdoor that had turned more than 1.3 million set-top boxes into a botnet. Google says, with high confidence, that the box maker Videostrong built and ran it for profit. It sold access to criminals for ad fraud and to route other people’s internet traffic.

TrendAI counted about 26,000 to 42,000 infected devices in each of Australia, the US, Germany, the UK and Canada. Google has taken down the servers that controlled the boxes. But the code is still on them, and owners can’t remove it themselves.

So what: check any cheap or unbranded Android TV box at home or in the shop, including menu screens and waiting-room TVs. Replacing it with one from a reputable maker is the reliable fix.

Read how to check your box.

From the 27.3 updates for iPhone, iPad, Mac and Vision Pro, Apple will check iCloud items shared with “Anyone with the link” for harmful content. Apple says it may remove flagged content, disable the Apple Account behind it or, if necessary, involve law enforcement.

Items shared with “People you choose” aren’t covered. Public links were already outside end-to-end encryption.

So what: for anything sensitive, such as a client contract or a payslip, switch the link to People you choose.

Read how to switch a link to invite-only.

4. One line to refuse AI training, for Google and Bing

Google and Microsoft announced on 30 October that they plan to honour one shared robots.txt signal for refusing AI training. Bing starts reading it on 1 February 2027, and Google aims to during 2027, treating it as a Google-Extended opt-out.

Bing says the new preferences don’t affect ordinary search results, and Google says the same of Google-Extended. Bing is also adding a separate page-level setting for whether your pages can feed its AI answers.

So what: if your site uses Bing’s old NoArchive or NoCache tags, set the new preferences before 1 March 2027. After that, Bing no longer reads those tags for training or AI answers.

Read what to add to robots.txt.

5. Texting under your business name could cost $17 to $25 a year per ID

The ACMA has proposed charging a yearly fee for every sender ID on the SMS Sender ID Register. Its indicative figure is about $17 to $25 per ID, paid when you register and again each year to stay on. It could rise if fewer IDs are registered.

Charging would likely start during 2027–28, with the ACMA proposing 1 July 2027. Existing IDs would need to re-apply and pay then.

So what: count every name your texts go out under. Submissions close at 5pm AEDT, 2pm in Perth, on Friday 4 December.

Read the proposal.

Win of the week

Xero is breaking its broad user roles into smaller permissions. A new hire can raise a purchase order or count stock without seeing the rest of the books. From November, Australian businesses on Xero’s new timesheets can also give someone timesheet approval and nothing else. See what’s changing.

Facepalm of the week

For about 11 hours on 29 and 30 October, Cursor’s extension marketplace offered a tampered copy of the Claude Code extension. It planted an attacker’s SSH key. Cursor’s own warning: uninstalling it “may not be sufficient”. Here’s how to check your computer.

Dates to watch

Date What happens
10 November 2026 Windows 11 23H2 Enterprise and Education get their last security update.
16 November 2026 Discord’s Server Web Pages go live for Discoverable Servers, and App Store Connect starts asking developers about dating and relationship features.
1 December 2026 Registered Android app stores can offer one-tap installs on Android 17 QPR2 and later.
4 December 2026 Submissions on the ACMA’s proposed SMS sender ID fee close at 5pm AEDT.
12 January 2027 Every App Store app must have answered Apple’s new age rating questions.
30 January 2027 Deadline for large card providers to publish October to December fee data, the first after the October cuts.
1 February 2027 Bing starts honouring the shared robots.txt AI training signal.
1 March 2027 After this date, Bing no longer reads NoArchive and NoCache tags as training or AI-answer preferences.
More in Rules & costs