Android Scam Detection Uses Gemini AI to Block SMS Fraud

Google is deploying a suite of on-device artificial intelligence defenses across the Android ecosystem to intercept text message scams, block fraudulent phone calls and prevent covert call forwarding. The rollout targets the most common vectors used in smishing and vishing attacks, which cost U.S. consumers billions annually according to Federal Trade Commission data.

The centerpiece of the update is an opt-in Scam Detection feature inside the Messages app. Powered by advanced Gemini models, the system evaluates sender intent rather than relying solely on traditional keyword filtering or blocklists. If a message exhibits behavioral patterns associated with social engineering — such as a stranger attempting to build rapport after claiming a wrong number — the system flags it before the user engages.

Unlike cloud-based spam filters that require transmitting message contents to external servers, Android processes these evaluations locally using Private AI Compute. This architecture encrypts messages and analyzes them in a secure environment inaccessible to outside parties, including Google. A separate layer powered by Gemini Nano inspects URLs embedded in texts from unknown contacts to verify link safety before they are opened. This on-device processing represents a significant shift from legacy SMS security, which historically depended on carrier-level filtering or reactive user reports.

Hardware requirements for the full link-analysis capabilities currently limit availability to newer devices, including the Pixel 10 series, Samsung Galaxy S26 lineup, Galaxy Z Flip 8 and Galaxy Z Fold 8. However, the broader scam notification warnings previously restricted to Pixel hardware are expanding through partnerships with Honor, Motorola, OPPO, OnePlus, realme, vivo and Xiaomi, with integration expected later this year.

Beyond messaging, Android 15 introduces automatic screen-sharing privacy protections rolling out this month. When users share their screens via Chrome or Android WebView, the operating system will automatically mask passwords, banking interfaces and credit card security codes. This defense addresses a prevalent tactic where fraudsters guide victims through screen-sharing sessions to harvest credentials in real time.

Covert call forwarding presents another vulnerability being patched in early December. Malicious apps or social engineers sometimes trick users into dialing Man-Machine Interface (MMI) codes — short numeric strings like *72 — that silently route incoming calls to attacker-controlled numbers. The upcoming protection blocks background applications from enabling this function and warns users if they attempt to input forwarding codes manually.

In Brazil, where bank impersonation calls represent a severe financial threat, Google partnered with local financial institutions to implement real-time caller verification. Android now performs authentication checks on incoming calls purporting to be from banks. If the caller fails verification, the system terminates the connection and alerts the user. Since its June launch, this mechanism has blocked more than three million fraudulent calls. A timeline for bringing this specific bank-verification tool to the United States remains unconfirmed, though Google indicated plans to onboard additional banking partners globally.

Redesigned warning interfaces now provide extended context and introduce deliberate delays before users can tap links sent from numbers outside their contact lists, adding friction to rapid-response social engineering tactics. The opt-in messaging security settings begin reaching eligible devices in the coming weeks.