The moment between a scammer asking for a one-time passcode and a victim typing it into a phishing page has become the most dangerous point in modern mobile fraud. Cybercriminals no longer rely on a single malicious file or a suspicious link. They now stage entire attack sequences: a spoofed bank number creates urgency, an AI-generated voice adds authority, a screen-sharing request builds false trust, and a forwarded call captures the OTP needed to drain an account. Google’s latest Android security update is designed to break that chain before the final handoff occurs.
Android Blocks Scam Calls and OTP Theft With a New AI Protection Playbook
Google has announced a new layered set of security defenses for Android that target the most dangerous stage of a scam: the point at which users are about to share passwords, payment details, or verification codes. Instead of relying only on known spam numbers and malicious URL blocklists, Android will combine on-device AI, cloud-based analysis, privacy protections, and real-time checks to identify suspicious behavior in calls, messages, web links, and banking interactions.
The moment between a scammer asking for a one-time passcode and a victim typing it into a phishing page has become the most dangerous point in modern mobile fraud.
The move reflects how quickly mobile scams have evolved. Criminals now use spoofed phone numbers, fake bank alerts, phishing pages, remote screen-sharing sessions, and AI-generated voices to trick victims into approving fraudulent transactions. Existing AI-powered scam detection in Phone by Google and Google Messages already identifies more than five million suspected scam calls and texts every month. The new protections go further by trying to prevent users from ever reaching the point where they hand over the one piece of data a scammer needs most.
Enhanced Protection in Google Messages: An Opt-In Layer for Complex Scam Conversations
The most visible addition is an opt-in Enhanced Protection mode in Google Messages. Google said the setting will begin rolling out in the coming weeks and will activate stronger protections for complex messaging scams. At the heart of this mode is expanded Scam Detection built on Google’s Private AI Compute platform, which allows Gemini models to review the context of a conversation with an unknown sender.
The goal is to catch slow-moving social engineering attacks in which criminals build trust over several messages before sending a fraudulent request or link. By analyzing conversational patterns rather than just individual message contents, the system can flag suspicious behavior that would otherwise look harmless in isolation. Google said the analysis runs in an encrypted environment that Google employees cannot access.
What Is Enhanced Protection Mode in Google Messages?
Enhanced Protection mode is an opt-in security setting in Google Messages that enables deeper AI-driven scam detection and stronger link analysis. It uses Gemini models through Google’s Private AI Compute platform to review conversation context with unknown senders and Gemini Nano to inspect unfamiliar web links before they are opened. The setting is scheduled to roll out in the coming weeks.
AI-Powered Link Checks for Phishing Pages That Blocklists Miss
Enhanced Protection also strengthens link verification in Google Messages. Scammers frequently create new phishing domains that have not yet been added to standard threat blocklists, which makes conventional URL filtering less reliable. To close that gap, Google said Gemini Nano will combine real-time web signals with local on-device analysis to evaluate unfamiliar links before a user opens them.
Android will also show redesigned warnings for links sent from phone numbers not saved in the user’s contacts. This acts as an extra checkpoint, giving users a moment to reconsider before visiting a page that could be designed to steal login credentials or payment card information.
Scam Alerts Are Expanding From Pixel to the Wider Android Ecosystem
The update also brings a feature that was previously limited to Pixel phones to a much broader audience. Scam Detection in chat notifications can flag suspicious messages from supported chat apps directly in the notification panel, allowing users to see a warning before they even open the message. This is particularly useful for users who receive a fraudulent link or payment request in a third-party messaging app rather than in Google Messages.
Google said it is working with Android device makers to bring this on-device feature to hundreds of millions of additional users later this year. That expansion marks one of the most meaningful efforts to make AI-driven scam detection a standard part of the Android experience rather than a premium device feature.
How Android Blocks the OTP Theft Techniques Scammers Rely On
Two of the most dangerous mobile scam techniques involve screen sharing and call forwarding. In both cases, the attacker uses the victim’s own device against them, often while impersonating a bank or telecom support agent.
Android Hides Passwords and Payment Screens During Active Screen Sharing
Phone-based social engineering increasingly involves persuading victims to share their screen with a fake support representative. Through remote screen-sharing sessions, criminals can watch every keystroke and every piece of sensitive data displayed on the device. Android will now automatically hide login fields and payment screens during active screen-sharing sessions in Chrome and Android WebView. That means password boxes, card numbers, and other sensitive fields will not appear on the screen while a scammer is watching.
Android Blocks Silent Call Forwarding That Intercepts Verification Codes
Call-forwarding abuse is one of the most direct paths to OTP theft. A threat actor may trick a user into entering a call-forwarding code, which redirects incoming calls containing verification codes to a criminal-controlled number. Once the OTP is received on that number, the scammer can use it to complete a password reset, bypass multi-factor authentication, and take over a bank account or email inbox.
Android will now block apps from silently enabling call forwarding in the background. It will also warn users before a manually entered MMI forwarding code takes effect. These short dialing sequences, often beginning with symbols such as * or #, are commonly used to enable unconditional call forwarding. The new warning is designed to give users a clear moment to cancel the action if they were tricked into entering it.
Verified Financial Calls Add a Bank-Level Trust Check
Google is also expanding verif18financial calls, a feature developed in partnership with banks including Banco do Brasil and Itaú Unibanco. The system checks whether a call claiming to come from a bank was actually initiated by the bank’s official mobile app. If the verification fails, Android can end the call and alert the user that the caller may be fraudulent.
The feature appears to be having a substantial impact. Google said it has blocked more than three million spoofed calls involving the two Brazilian banks since the feature launched in June. That numbers shows how quickly verified-caller systems can pay off, especially in markets where banking fraud and SIM-swap-style attacks are widespread.
Traditional Blocklists vs. AI-Driven Scam Defense: A Quick Comparison
| Scam Technique | Traditional Defense | New Android AI Defense |
|---|---|---|
| Spoofed bank calls | Caller ID filters and spam lists | Verified financial calls confirm whether a bank app initiated the call |
| New phishing domains | URL blocklists that update after threats are reported | Gemini Nano analyzes unfamiliar links in real time before they open |
| Social engineering text conversations | Keyword matching and simple sender reputation | Gemini models review conversation context to detect gradual manipulation |
| OTP interception via call forwarding</td | Limited user education | Android blocks silent call forwarding and warns before MMI codes are applied |
| Screen-sharing fraud | User caution | Android hides login and payment fields during active screen-sharing sessions |
The Privacy Architecture Behind Android’s On-Device Scam Detection
One of the more consequential aspects of this update is where the AI analysis happens. Google is placing much of the new scam-detection workload on-device, which has two benefits: it reduces latency and removes the need to send private conversation content to a remote server. The use of Private AI Compute gives Google a framework for running machine-learning models on-device while keeping the user’s data protected. According to Google, the analysis takes place in an encrypted environment that even Google employees cannot access.
That architecture matters because scam detection is inherently privacy-sensitive. A system that scans every text message or chat notification for manipulative language has the potential to become a surveillance tool if built incorrectly. Google’s stated approach is to keep the most sensitive part of the analysis local, with cloud-based analysis reserved for tasks such as checking links against current web signals. For security-conscious users, that balance could make AI-driven scam protection more acceptable than a purely cloud-based alternative.
The shift from static blocklists to behavior-based fraud detection also reflects a broader industry movement. Legacy mobile security tools were built for a world where threats had fixed signatures and known command-and-control servers. Modern scams are dynamic: they exploit trusted communication channels, use legitimate banking tools against their victims, and adapt quickly to new defenses. AI models that can understand intent, context, and conversation flow are better suited to this environment than a database of known bad actors.
What Users Should Do While Android’s New Defenses Expand
Even with these protections in place, the human layer remains critical. Users should avoid sharing passwords, card information, recovery codes, or one-time passcodes over calls and messages, even when the caller or sender appears to be a legitimate bank or government agency. Scammers are skilled at spoofing caller ID and mimicking official language, and no app-based defense can work if a user voluntarily reveals an OTP.
Android owners who receive a suspicious call forwarding request, a screen-sharing prompt, or an urgent request for a verification code should treat it as a red flag. The new AI defenses are designed to catch these patterns earlier, but they are not a substitute for basic caution. When Enhanced Protection mode becomes available in Google Messages, users should enable it, especially if they regularly communicate with unknown numbers or work in environments where phishing attempts are common.
App updates and OS updates will also play a major role. Because several of these protections require system-level changes to Android, Chrome, and Android WebView, users need to install updates as they become available. The arrival of on-device scam detection across a wider ecosystem later this year will depend on device manufacturers actually shipping the new code to their users.
The bigger picture is clear: Android is moving from stopping obvious spam to understanding the shape of a scam. By combining on-device AI, conversation-level analysis, verified caller identity, and system-level blocks against OTP theft, Google is building a defense that targets the moments where fraud actually succeeds. The next phase of mobile security will not be judged by how many malicious files it catches, but by how effectively it stops a user from giving away the one code that should never be shared.
- What is Enhanced Protection mode in Google Messages?Enhanced Protection mode is an opt-in security setting that enables deeper AI-driven scam detection and stronger link analysis using Gemini models.
- How do Verified Financial Calls work?The system checks whether a call claiming to come from a bank was actually initiated by the bank's official mobile app, and if verification fails, Android ends the call.
