Full Report
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
Analysis Summary
# Best Practices: Android AI-Powered Scam & Fraud Defenses
## Overview
These practices address the rising sophistication of mobile-based social engineering, including AI voice cloning, fraudulent bank alerts, spoofed numbers, and malicious call forwarding. The goal is to leverage Google’s new AI-driven on-device and cloud-based protections to mitigate the risk of financial loss and credential theft.
## Key Recommendations
### Immediate Actions
1. **Enable Scam Detection for Messages:** Navigate to Google Messages settings and opt-in to the new Gemini-backed cloud analysis for unknown senders.
2. **Update Core Systems:** Check for and install the latest Android System and Play Store updates to ensure the Gemini Nano local AI model is active.
3. **Audit Call Forwarding:** Check current call forwarding status by dialing `*#67#` or `*#21#` to ensure no unauthorized redirections are active.
4. **Enforce Screen Sharing Protocol:** Instruct users to never share screens during sensitive transactions; however, ensure Chrome and WebView are updated to the latest version to activate automatic masking of login/payment fields.
### Short-term Improvements (1-3 months)
1. **Bank Verification Enrollment:** If your organization uses corporate banking, ensure your financial institution (e.g., Revolut, Banco do Brasil, etc.) is integrated with Google’s Verified Bank Calls system.
2. **User Awareness Training:** Update phishing simulations to include "bank spoofing" and "AI voice cloning" scenarios, emphasizing that users should independently verify callers through official apps.
3. **Policy Update:** Update Mobile Device Management (MDM) policies to require the latest OS versions that support "Sensitive Information Masking" during remote sessions.
### Long-term Strategy (3+ months)
1. **Zero-Trust Mobile Access:** Transition toward a model where mobile identity is verified via hardware-backed security keys rather than SMS/voice-based OTPs, which are susceptible to the scams these AI defenses are fighting.
2. **Hardware Lifecycle Management:** Plan for the phased replacement of older Android devices that do not support on-device AI (Gemini Nano) to ensure all employees have hardware-level protection.
## Implementation Guidance
### For Small Organizations
- **Manual Configuration:** Educate employees to manually toggle on "Scam Detection" in Google Messages and "Verified Calls" in the Phone app.
- **Verification First:** Establish a "call back" policy where employees must hang up and call a known official number if a "bank" or "tech support" reaches out.
### For Medium Organizations
- **Centralized Documentation:** Provide a step-by-step guide for employees on how to activate Gemini-backed protections on their work-profile devices.
- **App Vetting:** Use Google Play Protect to ensure no malicious apps are attempting to use MMI codes for call forwarding.
### For Large Enterprises
- **MDM Enforcement:** Use Mobile Device Management (MDM) solutions to push configurations that prevent screen sharing in sensitive apps and ensure "Play Protect" is always enabled.
- **Integration:** Work with telecom providers to ensure enterprise numbers are registered correctly to avoid being flagged by AI-driven scam filters.
## Configuration Examples
*While specific CLI/Config scripts are not provided in the article, the following logic applies to the UI:*
**Enabling Gemini-backed Message Protection:**
1. Open **Google Messages**.
2. Tap **Account Profile Icon** > **Messages Settings**.
3. Select **Spam Protection**.
4. Toggle **Enable Scam Detection** (Ensure the "Cloud-based analysis" option is checked).
**Manual Call Forwarding Check:**
* **Command:** `*#62#` (Checks for redirection when unreachable).
* **Command:** `##002#` (Universal code to disable all conditional call forwarding).
## Compliance Alignment
- **NIST SP 800-124 Rev. 2:** Guidelines for Managing the Security of Mobile Devices in the Enterprise.
- **CIS Android Benchmark:** Configuration profiles for securing Android devices.
- **ISO/IEC 27002:** Controls related to information transfer and mobile computing.
## Common Pitfalls to Avoid
- **False Sense of Security:** Assuming AI will catch 100% of scams. Users must still be trained to recognize social engineering cues.
- **Ignoring MMI Warnings:** Users often click through "Call Forwarding" warnings (MMI codes) without reading them. Training must emphasize the danger of these prompts.
- **Delayed Updates:** Failing to update Android WebView, which is now critical for masking sensitive data during screen sharing.
## Resources
- **Google Security Blog:** [blog.google/security/new-android-scam-protections/](https://blog.google/security/new-android-scam-protections/)
- **Google Play Protect Documentation:** [support.google.com/googleplay/answer/2812853](https://support.google.com/googleplay/answer/2812853)
- **Android Enterprise Security:** [android.com/enterprise/security/](https://android.com/enterprise/security/)