Google is introducing new Android protections designed to catch sophisticated mobile scams before they steal money, redirect calls or expose sensitive information. The update targets a growing problem: fraudsters who use convincing messages, impersonated bank calls and social engineering to trick people into handing over access to their accounts.
Google is expanding Android’s built-in defences against mobile scams, introducing AI-powered message analysis, stronger protection against fraudulent calls and new safeguards designed to prevent sensitive information from being exposed during screen sharing. Announced on October 14, 2026, the updates target increasingly sophisticated fraud tactics, from fake bank alerts and malicious links to caller ID spoofing and call-forwarding scams.
Mobile Scams Are Becoming Harder to Spot
A message that appears to come from a bank, a phone call displaying a familiar number or a link sent during an apparently ordinary conversation can be enough to start a costly fraud. Scammers are increasingly using convincing impersonation techniques and carefully staged conversations to build trust before asking victims to disclose sensitive information or transfer money.
Google says its AI-powered scam detection in Google Phone and Google Messages already flags more than five million suspected scam calls and messages each month. The new capabilities are intended to address more sophisticated attacks that may evade conventional filters, including scams that develop over several messages rather than relying on an obvious phishing link.
The announcement matters because mobile devices have become central to banking, workplace communication, identity verification and access to online services. A compromised phone number or a successful social engineering attack can provide criminals with a route to financial accounts and business systems.
Google Messages Gets a More Advanced Scam Detection Mode
One of the most significant changes is Enhanced protection mode in Google Messages, an optional setting designed to strengthen detection of sophisticated messaging scams.
Traditional scam filters can identify known malicious links, suspicious phrases and previously reported numbers. More advanced fraud, however, often depends on context. A criminal might begin with an innocent-looking conversation, gradually establish credibility and only later introduce a fraudulent investment, an urgent payment request or a request for account credentials.
Google says Enhanced protection will combine existing on-device detection with more capable cloud-based AI analysis through its Private AI Compute environment.
According to the company, this approach allows its Gemini models to evaluate the context of conversations involving unknown senders and identify suspicious intent that may not be obvious from an individual message.
Google says Private AI Compute is designed to process data in a secure, encrypted environment that prevents access by Google or other parties. These are the company’s stated privacy protections; users should consult the relevant product documentation to understand how the feature works and what data processing applies.
Enhanced protection also introduces a smarter approach to checking unfamiliar links. Google’s on-device Gemini Nano model will use real-time web signals to help assess whether a link may be dangerous, including links to websites that have not yet been identified by conventional threat intelligence systems.
The feature builds on existing protections that warn users about known malicious URLs. Redesigned warnings will also give people more context and an additional opportunity to reconsider before opening links received from numbers outside their contacts.
Google says Enhanced protection will begin rolling out in the coming weeks. Availability may vary by device, software version and region.
Scam Alerts Are Expanding Beyond Pixel Phones
Google is also working with other Android device manufacturers to expand scam detection in chat notifications.
Previously introduced on Pixel devices, this feature can flag suspicious messages directly in the notification shade, potentially warning users before they open a messaging application.
That matters because users often respond to notifications quickly, sometimes without checking the sender or reading the surrounding conversation. A warning delivered at that moment could interrupt an attack before a victim follows a malicious link or engages further with a scammer.
Google says it plans to bring this on-device protection to hundreds of millions of additional users through partnerships with Android manufacturers later in 2026.
The expansion could make scam detection more accessible across the Android ecosystem, although the exact reach will depend on participating manufacturers, supported devices and regional availability.
For businesses that rely on messaging applications for customer communication, payments and operational coordination, these protections may provide another layer of defence. They should not, however, replace anti-phishing controls, employee training or established procedures for verifying sensitive requests.
Android Adds Safeguards Against Call Forwarding Scams
Messaging is only one part of the problem. Fraudsters also use telephone calls to persuade victims to disclose one-time passcodes, reveal banking details or change settings that give criminals greater control over their communications.
One particularly concerning tactic involves call forwarding. A scammer may convince a victim to enter a special code into the phone’s dial pad, redirecting incoming calls to a number controlled by the attacker.
If the victim’s phone number is used for account recovery or voice-based verification, this redirection may help criminals intercept sensitive communications and attempt account takeover.
Google says Android is introducing safeguards designed to prevent applications from silently enabling call forwarding in the background. The system will also warn users when they are tricked into manually entering certain call-forwarding codes.
These measures are intended to make a commonly abused process harder to manipulate without the user’s understanding.
The protection is especially relevant for people who rely on phone calls to verify financial transactions, recover accounts or communicate with service providers. It is also a reminder that protecting an account requires more than securing its password: attackers may target the recovery and verification channels around it.
Screen Sharing Could Become Safer for Passwords and Payments
Another update addresses the risks associated with screen sharing.
Scammers frequently pose as bank employees, technical support agents or customer service representatives. They may persuade a victim to share a screen while supposedly helping to resolve a problem, then observe credentials, payment information or other sensitive details as they are entered.
Remote assistance tools can be legitimate, but screen sharing becomes dangerous when the person on the other end is untrustworthy.
Google says Android’s existing safeguards for sensitive information in native applications will be extended to Chrome and Android WebView. During live screen-sharing sessions, the system will automatically blank out certain login fields and payment screens.
The goal is to prevent passwords and payment details from being exposed to someone watching the screen.
This is a useful additional safeguard, but it should not be treated as a guarantee that all sensitive information will remain hidden. Coverage depends on supported applications and system behaviour, and scammers may still obtain information through other methods.
Users should never assume that a person requesting screen access is legitimate simply because they claim to represent a bank, a technology company or a government agency.
Verified Financial Calls: Android Targets Bank Impersonation
Google is also expanding its work on verified financial calls, a feature designed to help distinguish genuine calls from fraudsters impersonating financial institutions.
Caller ID spoofing allows criminals to manipulate the number displayed on a recipient’s phone, making an incoming call appear to originate from a trusted organization. As a result, even a familiar-looking number may not establish who is actually calling.
Google says it has partnered with Banco do Brasil, Itaú Unibanco and other financial institutions to verify incoming calls against information supplied through participating banks’ official applications.
Under this system, an incoming call claiming to be from a participating bank is checked in real time. If the call fails the verification process, Android can end it and alert the user, according to Google’s description.
The company reports that, since the feature launched in June 2026, it has blocked more than three million spoofed calls involving Banco do Brasil and Itaú Unibanco. Google also says the service is protecting customers of other financial institutions, including Revolut, with further expansion planned.
These figures are Google’s reported results and have not been independently established by the source material provided here. Nevertheless, the approach highlights an important direction for mobile fraud prevention: verifying the origin of a communication rather than relying on the number displayed on the screen.
For banks, payment providers and digital financial services, this could offer a stronger way to establish trust in customer communications. Wider adoption will depend on participation from financial institutions, technical integration and availability in individual markets.
What the New Protections Mean for the Middle East and Africa
Mobile banking, digital payments and messaging-based customer service are important parts of the technology landscape across the Middle East and Africa. As more services move to smartphones, criminals have additional opportunities to exploit trust in familiar brands and everyday communication channels.
A convincing fake bank call can target an individual customer. A fraudulent message sent to an employee can also become the starting point for business email compromise, credential theft or unauthorized payments.
The new Android protections could help reduce some of these risks, particularly when a suspicious message or call is flagged before a user acts. However, the announcement does not mean that all features are immediately available across MEA markets, nor does it establish that every Android device supports them.
Organizations should confirm the availability of specific protections on their employees’ devices and maintain independent controls for financial transactions, account recovery and access to corporate resources.
Banks and other regulated businesses should also continue to strengthen customer verification procedures and provide clear guidance on how legitimate staff communicate with customers. Where possible, customers should be encouraged to contact institutions through official applications or independently verified telephone numbers rather than relying on details supplied during an unsolicited call.
For cybersecurity teams, the development reinforces the importance of combining technology with effective cybersecurity training and awareness. Users need to recognize social engineering, understand the risks of screen sharing and know how to verify unexpected requests for money or sensitive information.
Ten Practical Steps to Reduce Mobile Scam Risk
Android’s new protections can help identify suspicious activity, but users and security teams should continue to follow established security practices.
- Keep Android and applications updated. Install security updates and supported application versions promptly. Confirm whether the new protections are available on the devices in use.
- Enable available scam detection features. Review Google Messages and phone security settings, including Enhanced protection mode when it becomes available on your device. Check regional and device requirements.
- Treat unexpected links with caution. Avoid opening links in unsolicited messages, even when they appear to come from a familiar organization. Navigate to the organization’s official website or application independently.
- Verify unexpected bank calls. Do not rely solely on caller ID. End suspicious calls and contact the bank through its official application or a trusted number obtained independently.
- Never disclose one-time passcodes. Do not share OTPs, passwords, recovery codes or authentication approvals with someone who contacts you unexpectedly, even if they claim to be a bank employee or support technician.
- Be cautious with screen sharing and remote access. Do not share your screen or install remote-control software at the request of an unsolicited caller. If assistance is necessary, initiate contact through an official support channel.
- Review call-forwarding settings. Be wary of instructions to enter unfamiliar codes into your dial pad. If you suspect that calls have been redirected, contact your mobile operator and verify the settings.
- Strengthen account security. Use unique passwords, a password manager and multifactor authentication where available. Prefer phishing-resistant authentication for high-value business accounts.
- Establish verification procedures for payments. Organizations should require independent confirmation for changes to supplier bank details, urgent transfers and unusual financial requests. A second communication channel can help prevent impersonation fraud.
- Train employees and monitor incidents. Provide regular security awareness training on mobile phishing, social engineering and impersonation scams. Establish a straightforward process for reporting suspicious messages and calls, and investigate repeated attempts.
These measures remain important even when a device includes advanced scam detection. Automated protections can miss new attack techniques, and criminals continually adapt their methods.
Independent Testing and Google’s Claims
Google’s announcement also cites an evaluation commissioned by the company and conducted by Leviathan Security Group. The assessment compared built-in scam protections across Android and iOS, with Google reporting that Android performed better across several categories, including proactive call screening, fake-call detection and threat warnings through Circle to Search.
Google also references a YouGov survey of 4,500 smartphone users across the United States, Canada and Australia. In that survey, 40% of respondents reportedly said they were very or extremely concerned about mobile fraud.
These findings provide context for Google’s product decisions, but readers should distinguish vendor-commissioned research from an independent, comprehensive assessment of every device and scam scenario. Results can depend on the devices tested, the features available, the testing methodology and the threats included.
The broader point is clear: users are concerned about mobile fraud, and platform providers are increasingly using on-device analysis, cloud-based AI and real-time verification to detect threats that traditional filters may overlook.
Whether these features materially reduce fraud at scale will depend on their effectiveness in real-world conditions, their availability across devices and regions, and how quickly attackers adapt.
The Bigger Picture: AI Is Changing Both Sides of Mobile Fraud
Artificial intelligence is giving security teams new ways to identify suspicious messages and interpret patterns that may indicate fraud. At the same time, criminals can use increasingly convincing language, impersonation techniques and automated conversations to make scams more difficult to recognize.
That creates a continuing contest between detection and deception.
Google’s latest Android protections reflect a move away from relying exclusively on lists of known malicious numbers and websites. Instead, the company is combining contextual message analysis, real-time link assessment, device-level warnings and verification of financial calls.
These layers may help interrupt an attack earlier, before a user transfers money, reveals credentials or grants access to sensitive information. They also illustrate why mobile security increasingly depends on coordinated safeguards across operating systems, applications, financial institutions and telecommunications providers.
For businesses looking to strengthen their wider security posture, Saintynet Cybersecurity provides a starting point for exploring cybersecurity services, risk management and professional training. Additional threat reporting and security analysis are available through Cybercory.
Conclusion
Google’s new Android protections target several common routes used by mobile scammers: deceptive messages, malicious links, impersonated bank calls, fraudulent call forwarding and the exposure of sensitive information during screen sharing.
The measures will not eliminate mobile fraud, and their availability will vary across devices and markets. Still, they represent a useful shift toward detecting suspicious behaviour earlier and giving users more opportunities to stop before acting.
For individuals, the advice remains straightforward: question unexpected requests, verify who is contacting you and never disclose sensitive information simply because a caller or message appears trustworthy. For organizations, the priority is to combine device protections with strong authentication, secure financial procedures, incident reporting and continuous employee awareness.
The most effective defence against mobile scams is layered security: technology that detects threats, processes that limit the damage and people who know when to stop and verify.
Official source: Google Security Blog, New Android protections to help keep you safe from mobile scams, October 14, 2026.
