Google Android Flags 5 Million Suspected Scam Calls and Texts Monthly

Google says its Android scam-detection capabilities now flag more than 5 million suspected scam calls and text messages each month, as mobile fraud operators increasingly use caller-ID spoofing, fake banking alerts, conversational phishing, and AI-enabled voice impersonation techniques.

The company cited a YouGov survey of 4,500 smartphone users across the United States, Canada, and Australia, in which 40% of respondents said they were “very” or “extremely” concerned about mobile fraud.

Google Android Flags 5M Scam Calls and Texts Monthly

According to Google, the company is responding with new protections in Google Messages, Android’s phone stack, Chrome, and Android WebView.

A central update is an opt-in Enhanced Protection mode for Google Messages. The feature combines existing on-device scam detection with Google’s Private AI Compute environment, allowing cloud-based Gemini models to assess the context and apparent intent of complex conversations with unknown senders.

Google said the capability is designed to identify slower, multi-message social-engineering campaigns that may evade conventional spam filters.

Enhanced Protection also adds smarter URL analysis. Google Messages already warns users about known malicious links, but the new capability uses on-device Gemini Nano alongside real-time web signals to evaluate unfamiliar URLs before a recipient opens them.

Redesigned warnings for links from unsaved numbers are intended to introduce friction before users interact with potentially dangerous content.

Google is also expanding scam alerts in chat notifications. The feature, initially introduced on Pixel devices, analyzes suspicious messages directly from the notification shade before a user opens supported third-party chat applications.

Google said it is working with Android device manufacturers to extend the on-device protection to hundreds of millions of additional users later this year.

The latest Android changes also target social-engineering phone scams, particularly attacks that rely on screen sharing and one-time passcode interception.

Android will now automatically obscure login forms and payment pages in Chrome and Android WebView during active screen-sharing sessions.

The safeguard extends existing sensitive-content protections in native Android apps and is intended to prevent fraudsters from observing passwords, card details, and other high-value information while coaching victims over a call.

Google has also introduced call-forwarding protections. Android will block applications from silently activating call forwarding in the background and warn users when they attempt to enter an MMI code that could redirect incoming calls.

Such redirection can allow attackers to intercept SMS or voice-based one-time passcodes used in account takeover attempts.

Google separately highlighted verified financial calls, a real-time caller authentication capability developed with banks including Banco do Brasil and Itaú Unibanco.

When an incoming call claims to be from a participating bank, Android checks whether the institution actually originated it. Calls that fail verification can be terminated automatically, with an alert shown to the user.

Since the feature launched in June, Android has blocked more than 3 million spoofed calls impersonating Banco do Brasil and Itaú Unibanco, according to Google.

The company said the control specifically disrupts abuse of inbound-only bank phone numbers, which should not be used for outbound customer calls.

Google also pointed to a commissioned Leviathan Security Group assessment that concluded Android offers stronger default fraud protections than iOS across several tested capabilities.

Because the evaluation was commissioned by Google, the findings should be considered alongside independent testing and real-world telemetry.