Since the beginning of the COVID-19 pandemic, scientists and health authorities have relied on contact-tracing technologies to help manage the spread of the virus. Yet there’s a major flaw in a framework that many of these mobile apps utilize—one that attackers could exploit to ramp up false positive notifications.