Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices.
The new measures aim to address the increased sophistication of scams targeting mobile users, including fraudulent bank alerts and voice-cloning attacks.
“Mobile scams have evolved far beyond basic robocalls and phishing texts, turning into sophisticated operations that use spoofed numbers, fake bank alerts, and AI voice cloning,” Google says.
“With scams growing harder to spot, it’s nearly impossible for users to catch every red flag themselves,” added the tech giant.
Google says its existing Phone and Messages scam detection flags more than 5 million suspected scam calls and texts monthly, but the new measures are expected to catch even more threats.
Cloud-based scam analysis
The new protections focus on Google Messages and rely on cloud-based Gemini-backed analysis for complex conversations, scrutinizing them for signs of fraud.
The system analyzes conversations with unknown senders within the encrypted Private AI Compute environment, protecting user privacy at all times.
The new mode also adds on-device Gemini Nano (local AI model) checks for unfamiliar links using real-time web signals, plus clearer warnings before opening links from unsaved numbers.
The new cloud-based protections are currently disabled by default, allowing users to activate them.
Source: Google
Other improvements
Apart from the Google Messages protection, Google has also implemented the enhancements in other areas of the Android system:
- On-device scam detection in chat notifications, previously launched on Pixel, will reach hundreds of millions more users through Android device partners later this year.
- Android’s existing sensitive-information masking is now expanding to Chrome and Android WebView, hiding login fields and payment screens during live screen sharing.
- Android blocks apps from silently enabling call forwarding in the background and warns users before manually entered MMI forwarding codes take effect.
Source: Google
Google is also expanding its verified bank calls system, introduced earlier this year, adding financial institutions from more.
This system checks whether a real bank’s call center initiated an incoming call or if it is a spoofing attempt. If the verification fails, the call is automatically ended.
Google says that since June it has blocked over 3 million fraudulent calls of this kind for Banco do Brasil and Itaú Unibanco alone. Revolut and other global financial institutions are also supported.
Android users should upgrade to the latest release, keep apps updated, and independently verify caller/sender identities when receiving requests for account-related action or sensitive information.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.