Google beefs up Android security against scams and theft

Phone scammers rely heavily on urgency to make you bypass your own common sense. Google is finally building a system that steps in when you are about to fall for it.

Ahead of Google I/O at the Android Show, Google introduced a broad set of security and privacy protections designed to clamp down on call-driven fraud, screen-sharing exploits, and physical phone theft. Rather than just tossing up passive warnings, Android is beginning to actively shut off dangerous settings while an attack is likely happening.

Locking down the phone mid-call

The most aggressive additions arrive in Android 16. If you are on a phone call with an unknown number not saved in your contacts, the operating system will step in to block critical actions. You will not be able to side-load an unverified app for the first time from a browser or chat app, nor can you grant accessibility permissions. Because accessibility services are the primary way malicious apps take full control of a device, blocking that permission during an unfamiliar call effectively closes the trap.

Google is also cutting off scammers who instruct victims to shut down protections. Devices on Android 6 or later will simply be blocked from disabling Google Play Protect while a call is active. After you hang up, a reminder will prompt you to stop screen-sharing. In the UK, Google is running a pilot with select banks on Android 11+: open a banking app while sharing your screen with a stranger, and a full-screen warning will appear with a one-tap button to sever the screen share immediately.

Google Messages is also expanding its on-device AI scam detection to cover fraudulent crypto pitches, gift cards, fake toll road fees, fake billing, and impersonation attempts. Later this summer, Google Contacts on Android 10+ will introduce verification keys via QR code or numeric matching to guarantee end-to-end encryption. Crucially, if an attacker executes a SIM-swap attack and texts you from a new device, the contact will automatically flip to unverified.

Turning stolen phones into paperweights

Google is taking device theft just as seriously. The Identity Check feature, which previously debuted on Pixel and Samsung OneUI 7 devices, is expanding across Android 16. If you are away from trusted locations, changing your PIN, accessing passkeys, or disabling anti-theft controls strictly requires biometric authentication.

Factory Reset protections are getting significantly tighter later this year. If a phone is wiped without the original PIN or Google credentials, Android will lock down core functionality, ruining its resale value. Android 16 will also hide one-time passcodes from lock screen notifications if the phone is disconnected from Wi-Fi and has not been unlocked recently.

Other updates include live detection for apps that hide or alter icons on Pixel 6 and newer devices, upgrades to Advanced Protection Mode, and a unified Find My Hub for tracking belongings, friends, and family.

Why it matters

We think Google's shift from advisory warnings to contextual intervention is the right move.

For years, operating systems relied on dialogue boxes warning people that side-loading an APK or granting accessibility access was risky. In reality, a scammer shouting over the phone easily panics victims into tapping through whatever warnings appear. By tying restrictions directly to the context of an ongoing call with a stranger, Android removes the self-destruct button when users are most vulnerable.

For everyday users, the theft prevention measures address the nightmare scenario of losing a phone and watching secondary accounts get drained. Hiding one-time passwords while offline cuts off the quickest path thieves take to reset banking credentials. Meanwhile, bricking reset devices should directly reduce theft incentives across the entire Android ecosystem.

There is, of course, the classic trade-off: Android is gradually tightening its open-ended ecosystem to look much more like iOS. Power users who rely on quick side-loading might find the restrictions annoying, but for the vast majority of consumers, taking a few guardrails in exchange for keeping their life savings intact seems well worth it.