Google has announced a set of Android protections intended to disrupt fraudulent messages, spoofed bank calls and call-forwarding abuse. The measures combine cloud-based Gemini analysis, on-device link checks and new restrictions on how apps and users activate call forwarding.
The defenses are rolling out to eligible devices, according to a BleepingComputer report published on October 15, 2026. The report does not identify the supported Android versions, devices or regions, so users should not assume that every feature is immediately available on every Android phone.
Messages gains optional cloud analysis
Google Messages is receiving a cloud-based system designed to examine complex conversations with unknown senders for signs of fraud. Processing takes place within Google’s encrypted Private AI Compute environment and is backed by Gemini.
This protection is disabled by default, meaning users must activate it before their conversations can receive the additional cloud analysis.
A separate on-device check uses Gemini Nano, described as a local AI model, to assess unfamiliar links against real-time web signals. Messages will also display more explicit warnings before a user opens a link sent by a number that is not saved in their contacts.
Google says its existing Phone and Messages detection systems already flag more than 5 million suspected scam calls and texts each month. That figure covers the existing protections; it is not a measurement of how many threats the newly announced features have detected. Google expects the additions to identify further scams, but that remains a forecast rather than a reported result.
The company also plans to bring on-device scam detection in chat notifications—previously launched on Pixel phones—to hundreds of millions more users through Android device partners later this year. This is a planned expansion, not a completed rollout.
Screen sharing will conceal more sensitive fields
Android’s existing masking controls are expanding to Chrome and Android WebView. During live screen sharing, the system will hide login fields and payment screens.
The change addresses scams in which an attacker persuades a victim to share their display and then watches credentials or financial details being entered. Masking reduces that exposure, although it does not establish whether the person directing the session is legitimate.
Android tightens call-forwarding controls
The announced protections also target call-forwarding fraud, which can redirect incoming calls without the victim fully understanding what has changed.
Android will prevent apps from silently enabling call forwarding while running in the background. When a user manually enters an MMI code that would activate forwarding, the operating system will show a warning before the code takes effect.
These controls add friction at two points: an app attempting to make the change without an obvious user action, and a user being instructed to enter a forwarding code during a fraudulent call or message exchange.
Verified bank calls expand to more institutions
Google is also broadening a system that checks whether an incoming call genuinely originates from a participating bank’s call center. If verification fails, the call is automatically terminated.
The system was introduced earlier this year and is now being expanded to additional financial institutions, including Revolut and other global organizations. Google says verified bank calls have blocked more than 3 million fraudulent calls since June for Banco do Brasil and Itaú Unibanco alone.
That total has a narrower scope than Google’s monthly figure for suspected scam calls and texts: it refers specifically to calls blocked for those two banks since June.
What Android users should do
Because availability depends on device eligibility, users should check for Android system and application updates rather than assume that all protections are already active. Those who receive the new Google Messages cloud-analysis option will need to enable it manually.
Users should also independently confirm the identity of a caller or sender before providing sensitive information, changing account settings or following instructions involving MMI codes. A message that appears to come from a bank—or a voice that resembles someone familiar—should not be treated as proof of identity on its own.
