Google adds new scam protection to Android and Google Messages
Google announced new protections against phone scams in Android and Google Messages on 14 October 2026. They will not reach all phones at once, and no countries or dates have been announced for Bulgaria.
Passwords hidden during screen sharing
Chrome and Android WebView, the built-in browser many apps use to show web pages, will automatically hide login fields and payment screens while the screen is shared with someone else. Apps built specifically for Android have long had this protection. It now covers web pages too. The feature starts in October 2026 on phones with Android 15 and newer. Another description says it hides passwords, bank details and the code on the back of a card.
A scammer who talks someone into showing their screen can see everything on it. The new protection hides data as a password or card number is typed in. There is no sign that it hides the whole screen of a banking app.
Gemini checks messages and links
Google Messages is getting an "enhanced protection" option, which users have to turn on themselves. It sends conversations with unknown senders to Gemini cloud models, which look for scams that unfold slowly. Google says the processing happens in "Private AI Compute", a protected cloud environment, and that no one, including Google, can see the messages. The option will appear "in the coming weeks" on Pixel 6 and newer, Galaxy S24 and newer, the foldable Galaxy Z Fold 6 and Flip 6 and newer, and other phones with AICore.
Link checking relies on Gemini Nano, a small model that runs directly on the phone. It checks an unknown web address in real time and also catches newly registered sites that are not yet on blacklists. The requirements here are stricter: Pixel 10 and newer, Galaxy S26, Z Fold 8 and Flip 8, and "other selected devices".
Warnings before you open a link from a number that is not in your contacts target the SMS-and-link scam, which is common in Bulgaria too. The warnings are getting more detailed and give people more time to think. They work on Android 6 and newer. Until now they were available only in some countries, or when "Advanced Protection" was on. Google does not say which countries.
Until now, only Pixel phones showed a warning in the notification before the message was opened. Later this year it will reach hundreds of millions of phones from HONOR, Motorola, OPPO, OnePlus, realme, vivo, Xiaomi and others, but availability depends on the maker.
ESET says banks use text messages only for payment alerts and one-time codes. It lists deadlines such as "your account will be closed within 24 hours" and shortened links as signs of a scam.
Ban on secret call forwarding from December
From the start of December 2026, Android will stop apps from secretly turning on call forwarding. If a scammer talks someone into dialling a forwarding code themselves, the phone will warn them before the code takes effect. The protection starts on Pixel and "other selected devices". According to the descriptions, the aim is to stop the interception of one-time codes that banks send by phone call.
In May 2025, the National Police described a scam that starts with a call from a "police officer", who claims a loan was taken out with a forged power of attorney. A "bank employee" then joins in and insists the account be emptied and the money moved to a "safe" account, a crypto ATM or a courier. Because numbers are spoofed, the calls often look like they come from Bulgaria. The new Android protections do not stop such a call, because the scam is carried out by voice.
Police and banks advise people to hang up and call the number on the bank's website, not the one the caller gives. A1 says no institution in Bulgaria calls from a hidden number.
The protection against spoofed bank calls that Google is introducing is for Brazil only. Android checks the incoming call against the bank's official app and cuts it off if the check fails. Since June 2026, more than 3 million fake calls pretending to be from Banco do Brasil and Itaú Unibanco have been blocked, and Revolut already uses it. There is no word on whether or when it will reach Bulgarian banks.
Google also cites an assessment by Leviathan Security Group, commissioned by Google itself, in which Android's protections come out best.