Google is teaching Android to end phone calls that claim to come from a bank but cannot be confirmed as genuine. When a caller says it is a customer’s bank and the call fails a check against the bank’s own app, the phone drops the call by itself and alerts the person holding it. Google announced the expansion on Oct. 14, together with a block on call forwarding that apps try to switch on in the background.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The scale of the problem explains the urgency. Google says Scam Detection in Phone by Google and Google Messages already flags more than 5 million suspected scam calls and texts every month, and the company describes modern mobile fraud as a mix of spoofed numbers, fake bank alerts and AI voice cloning. In Brazil, the banking federation FEBRABAN put the danger plainly: “Bank impersonation via caller ID spoofing directly undermines customer trust in official bank communication.”
Verified financial calls and the Brazilian bank numbers
The mechanism, described in a post by Google Messages product manager Alberto Pastor Nieto and Android product manager Shaifali Bhandari, works in real time. Android checks an incoming call together with the official banking app to confirm whether the bank actually placed it. If a caller claiming to be a bank fails that verification, Android ends the call and tells the user what happened. The design targets calls that spoof inbound-only bank numbers, which real banks never use to phone customers.
Google says the results so far come mostly from Brazil. Since the program launched in June, Android has blocked more than 3 million spoofed calls from Banco do Brasil and Itaú Unibanco alone, and the same feature also protects customers of the digital bank Revolut. FEBRABAN data cited by Google shows Brazilian bank impersonation scams rising 195.7 percent over 12 months, which is the backdrop for those two lenders signing on first.
BleepingComputer’s report by Bill Toulas on Oct. 15 framed the October update as an expansion of a system introduced earlier this year. BleepingComputer’s May coverage of the Android 17 plan named Revolut, Itaú Unibanco and the Latin American digital bank Nubank as the first participants, and said the check compares the calling number against a list the banks supply. Google said that earlier version would reach Android 11 and later even though it debuted in Android 17.
Call forwarding and MMI codes
The second change closes a quieter route that scammers use to intercept calls. Android now stops apps from silently turning on call forwarding in the background, a trick that can send a victim’s incoming calls, including bank verification calls, to a number the attacker controls.
A related risk comes from social engineering. If a scammer talks someone into typing a forwarding code by hand, a so-called MMI code, Android now shows a warning before the code takes effect. Google says the forwarding protection starts in early December on Pixel phones and other select devices, so owners of many handsets will wait for it, and the company has not published a full device list or a country-by-country schedule for the bank-call check beyond the banks it named. The bank-call check and the forwarding block are separate layers: one catches a fake caller at the moment of the call, the other removes a way to hijack the real one.
Gemini link checks and the opt-in Messages setting
The Messages changes come with a catch worth knowing about. Google cites its own survey with YouGov in which 40 percent of smartphone users said they are very or extremely concerned about mobile fraud, which is the audience the opt-in setting has to reach before it protects anyone. The new enhanced protection mode is opt-in, so it is off by default, and Google said it would roll out in the coming weeks. When switched on, Scam Detection sends conversations with unknown senders to cloud Gemini models running inside Private AI Compute, while the on-device Gemini Nano model checks unfamiliar links against real-time web signals and shows clearer warnings before a link from an unsaved number opens.
Earlier Google work points the same direction. BleepingComputer’s account of the fake call detection feature reported on June 3 described a check that confirms a call really comes from a saved contact, available on Android 12 and later, starting with Pixel phones and enabled by default. The report on on-device scam detection reaching more Pixel devices noted that conversation analysis during calls is off by default and plays a beep so both parties know it is running.
Google also plans to extend chat-notification scam detection, previously limited to Pixel, to hundreds of millions more users through Android device partners later this year, and to widen masking of sensitive information on screen shares to Chrome and Android WebView. BleepingComputer’s practical advice was to update Android and apps, and to verify the identity of any caller or sender independently before acting on an account request.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
