Android has ended more than 3 million spoofed calls to two Brazilian banks since June, according to Google. Its Gemini upgrade for Messages runs in the cloud and is opt in.
When a phone rings with what looks like Banco do Brasil on the screen, Android asks the bank's own app whether the bank placed the call. If the answer is no, Android ends the call and tells the user. Google says the check has stopped more than 3 million spoofed calls since it launched in June. Those calls came from Banco do Brasil and Itau Unibanco alone.
The bank check is the most useful part of Google's latest set of scam defences, and it does not require AI.
It works because the party being impersonated holds the relevant fact. A bank knows whether it dialled. A classifier reading a message can only guess what the sender intends. That control is stronger than a model's guess. The AI features Google promotes alongside it are weaker, later and less widely enabled than the announcement suggests.
The 3 million came from the easy case, where the gains are measurable. Google says the system ends calls that spoof lines the banks use only for inbound traffic. Those numbers should never appear as the caller on a customer's phone.
Blocking a number that is never a legitimate outbound caller is a plain rule. It needs no judgement about tone or wording, so a convincing script cannot fool it. Google says it is also protecting Revolut customers. It cites a FEBRABAN figure that bank impersonation scams in Brazil rose 195.7% over 12 months.
The AI features are weaker and later. The main addition is an Enhanced protection mode for Scam Detection in Google Messages. Google describes it as opt in and rolling out in the coming weeks, so it is not live today.
It sends conversation context to Google's most capable cloud Gemini models inside what the company calls Private AI Compute. Google says that space is encrypted and inaccessible to anyone else, including Google.
Users must take that privacy promise on trust. They must also find and enable the setting before any of it applies to their messages.
Only the link check runs on the phone itself. It uses Gemini Nano with real time web signals. The link checkpoints previously limited to select countries or users of Advanced Protection are being widened.
Scam Detection in chat notifications has already launched on Pixel. Google says it will reach hundreds of millions more users through partners later this year. The named makers are HONOR, Infinix, iQOO, itel, JOVI, Motorola, OPPO, OnePlus, realme, TECNO, vivo and Xiaomi. Samsung is not among them for chat alerts. Galaxy S26 and Z Flip and Fold8 phones are on Google's list for the on device link check.
Two other changes are rules rather than models. Screen share privacy blanks login and payment fields in Chrome and Android WebView as well as native apps. It rolls out this month to Android 15 and later. Call forwarding protection stops apps quietly switching call forwarding on. It arrives starting early December on Pixel and select devices.
Opt in is the weak point of the AI route. Google says the cloud and extra context let the model catch slow scams, meaning grooming conversations that run for days and contain no obviously bad link. Private AI Compute is a fair trade for users who accept the privacy claim.
A setting that has to be found and enabled reaches the people who already worry about scams. The support page for chat message detection adds that it is available only on select Android devices and may not catch every scam. A rule that fires in the background for every customer of a participating bank reaches the person who never opens settings.
For a bank fraud or digital channels team in a market where impersonation scams are rising, the spending choice is clear. Register official outbound numbers and inbound only lines. Google points banks to its developer documentation for the integration, and only the bank can supply the ground truth.
The integration has costs. The bank must do work in its banking app and depend on one platform, while iPhone customers gain nothing from it. A bank that waits for the AI classifier to improve is waiting on a feature that requires each customer to opt in first.
The bank integration is why Google can report a count in the millions for two banks. The AI features have no comparable number yet because they are only now rolling out.
Google says Android outperformed iOS on proactive call screening, fake call detection and Circle to Search warnings. It backs that with an assessment by security firm Leviathan, described in Leviathan's own write up. Google commissioned the work.
Leviathan tested a Pixel 11 Pro, an iPhone 18 Pro, a Samsung Galaxy S26 and a Razr 2026, all on T-Mobile over one month. Per Google's blog, the Pixel 11 Pro scored 29 across 31 features, the Galaxy S26 26.75, the Razr 26 and the iPhone 18 Pro 17.75. Readers should weigh that as a result Google paid for.
Google also cites a YouGov survey of 4,500 adult smartphone users in the US, Australia and Canada. It says 40% were very or extremely concerned about mobile fraud. Scam Detection in Phone and Google Messages flags more than 5 million suspected scam calls and texts per month, Google says.
The next checks have dates. Google says it will keep bringing the verified call check to more partners and publishes developer documentation to support that. By 31 December, Google should have named at least one further bank or financial app.
Call forwarding protection follows from early December, giving the desk a second date to check. The measure of this announcement is whether other banks join Banco do Brasil, Itau and Revolut. That is the part that works without anyone turning anything on.