Google rolled out a significant upgrade to Android security aimed at curtailing mobile scams that span calls, texts, chat apps, phishing links, and the misuse of one-time passcodes (OTPs). The company’s latest defenses use AI-powered tools to intercept threats earlier, even before users accidentally reveal sensitive information like passwords or credit card details. These updates come in response to increasingly sophisticated scams involving spoofed numbers, fake banking alerts, AI-generated voices, and phishing pages.
What’s New Under the Hood
A core part of the update is an “Enhanced Protection” mode in Google Messages, set to roll out in the coming weeks. When enabled, this mode will apply more rigorous checks on content from unknown senders, using Google’s Private AI Compute system that leverages Gemini models to inspect message context under tighter privacy controls. The analysis takes place entirely on-device or with encrypted processing that Google staff can’t access.
To better catch malicious links—especially those from freshly minted phishing domains that haven’t been blocked yet—Android will now combine on-device AI models like Gemini Nano with cloud-based signals for real-time link evaluation. Messages from unsaved numbers will display stronger warning banners, helping users recognize potential risks before clicking through. Additionally, Pixel’s “Scam Detection in chat notifications” feature is expanding to more Android phones. This flags suspicious messages from supported chat apps directly in the notification panel, giving users early alerts without even opening the message.
Stopping Social Engineering and OTP Hijacking
Google is also targeting scams that rely on social engineering tactics, where criminals gradually earn trust through messages before demanding action. To counter these, Android will hide login fields and payment prompts during active screen-sharing sessions through Chrome or WebView, preventing fraudsters from seeing or collecting sensitive data while guiding victims through fake processes.
A common OTP theft trick—call forwarding—is also being addressed. Android will now block apps from silently enabling call forwarding in the background and provide warnings when a manually entered MMI code attempts to forward calls. On the financial front, Google is expanding a verified financial calls system in Brazil, which confirms whether calls claimed to be from banks are truly initiated by the institutions. Since June, the system has already blocked over three million spoofed calls tied to two Brazilian banks.
These new features represent a shift away from simply identifying spam toward detecting malicious behavior and preventing fraud before it escalates. Google’s existing AI tools, including those in Phone by Google and Messages, currently flag more than five million suspected scam calls and texts every month. The latest protections are meant to stop attacks earlier—particularly where traditional blocklists fail against emerging threats.
Why This Matters: As smartphone communication evolves, so do the tactics of scammers. Behavioral methods, like building trust over time or using phishing sites that aren’t yet recognized, demand defenses that are both smart and proactive. These Android upgrades push that boundary, combining privacy-conscious AI with stronger warnings and protections. Users should still remain vigilant—never share sensitive information over messages or calls—and watch for these settings rolling out to more devices in the coming months.
What to Watch: How quickly “Enhanced Protection” becomes available on non-Pixel Android phones, the real-world performance of on-device link scanning, and whether these measures decrease successful scams on a measurable scale.
