Android's New Scam Defences: What You Need To Turn On

Google has announced a set of AI-powered defences for Android aimed at scam messages, fake bank calls, and background call-forwarding abuse. The features are rolling out gradually to eligible devices rather than arriving everywhere at once. Google says its existing scam detection already flags more than 5 million suspected scam calls and texts a month, and the new tools are meant to catch the more convincing attempts, including fake bank alerts and AI voice-cloning calls.

What this actually means for you

There are several separate pieces here, not one single update.

Google Messages is getting cloud-based scam analysis, powered by Gemini, that looks more closely at complex conversations with unknown senders. This runs inside what Google calls its Private AI Compute environment. Importantly, this is disabled by default. It will not protect you unless you go into settings and turn it on.

There's also a new on-device mode using Gemini Nano to check unfamiliar links in real time, plus clearer warnings before you open a link from a number you haven't saved. On-device scam detection in chat notifications, already available on Pixel phones, is set to reach hundreds of millions more Android users through device partners later this year, though the exact timeline and which phones varies.

Android is also closing off a trick where apps silently turn on call forwarding in the background. You'll now get a warning before manually entered forwarding codes take effect too. Separately, sensitive-information masking, which hides things like login fields and payment screens during screen sharing, is expanding from its current coverage into Chrome and Android WebView.

Finally, Google is expanding its verified bank calls system. This checks whether an incoming call genuinely came from a bank's call centre or is a spoofed number, and ends the call automatically if it fails that check. Google says it has blocked over 3 million fraudulent calls of this type since June for Banco do Brasil and Itaú Unibanco, with Revolut and other financial institutions also supported. It is not stated whether any UK banks are part of this system yet.

What to do

• Update your phone. Check for a system update and update Google Messages through the Play Store. None of the newer protections help if you're on an old version.
• Turn on the cloud-based scam detection manually. Open Google Messages settings and look for the scam or spam protection option. Because it's off by default, doing nothing means you don't get it.
• Treat unknown numbers with normal caution. The new warnings before opening links from unsaved contacts are a prompt, not a decision made for you. Read them.
• Never act on urgency alone. If a text or call claims your bank account needs attention right now, hang up or close the message. Call your bank back using the number on your card or their official app, not a number given to you in the message.
• Don't assume your bank is covered. Unless you know for certain your bank uses Google's verified calls system, treat every unexpected bank call as unverified until you've checked it yourself.

What this does not fix

This update does not make scam calls or texts disappear. It flags more of them and makes some actions harder to do by accident, but a determined and convincing scammer can still get through, particularly if you haven't switched the new settings on.

It also doesn't cover every phone immediately. The rollout depends on your device and your manufacturer, and some features are explicitly arriving "later this year" through partners, not today. If your phone hasn't received these updates yet, the older protections are what you're relying on, which is still useful but not the same thing.

None of this replaces basic verification habits. AI voice-cloning calls are specifically mentioned as one of the threats this is meant to address, which tells you the problem is serious enough to build defences for, not that the defences remove the risk. If someone calls sounding exactly like your bank, your mother, or your boss and asks for money or codes, verify independently before you act. That part is still down to you.