Skip to content
NewsProduct launch

Google adds opt-in cloud Gemini scam scanning to Google Messages

· by Pondero Newsdesk

The short version

Google's October 14 Android security update adds an opt-in Enhanced protection mode that sends unknown-sender conversations to cloud Gemini models, plus call-forwarding and screen-share safeguards.

Google adds opt-in cloud Gemini scam scanning to Google Messages

Google started rolling out a new Android defense on October 14 that hands unknown-sender text conversations to its most capable cloud Gemini models, a step up from the on-device scanning Android has relied on until now.

What happened

The new setting, called Enhanced protection mode, is opt-in and begins rolling out to Google Messages "in the coming weeks," per Google's announcement. It is a new security toggle inside the Google Messages app itself, Google's post says, though neither Google's announcement nor BleepingComputer's report specifies the exact settings-menu path or which devices get it first, so a reader who wants it will need to watch their own Messages app for the update rather than hunt for it today. Once a user turns it on, Scam Detection can send conversations with unknown senders into Private AI Compute, where cloud Gemini models read the full message context to catch slow-burn scams that unfold over several messages rather than a single suspicious text. The company says the data stays encrypted inside that compute environment and is inaccessible even to Google itself. The same opt-in mode also turns on-device Gemini Nano loose on unfamiliar links, checking them against real-time web signals before a tap, since scammers often register brand-new domains that have not yet been blocklisted. Google separately confirmed existing Scam Detection already flags more than 5 million suspected scam calls and texts a month, and that a verified-call system built with Banco do Brasil and Itau Unibanco has blocked more than 3 million spoofed bank calls since it launched in June 2026.

Three more scam paths get closed off at the same time

Google bundled three defenses that do not depend on the opt-in cloud scanning. Chat-notification scam alerts, previously limited to Pixel phones, are expanding to "hundreds of millions" more devices later this year through device-maker partnerships, according to the same announcement. Android is also extending its existing practice of blanking login and payment fields during screen-share sessions, a protection that already covers native apps, so that it now covers Chrome and Android WebView too; that closes a path scammers have used to walk victims through live screen shares and read off one-time codes as they are typed. A third change blocks apps from silently turning on call forwarding in the background and warns users before a manually typed MMI forwarding code takes effect, cutting off a technique scammers use to redirect one-time passcodes to a number they control. None of the three require a user to flip a new setting first.

Context

Google's push comes with numbers meant to justify it: a YouGov survey of 4,500 smartphone users that Google commissioned found 40% are now "very" or "extremely" concerned about mobile fraud, Google's post adds. A separate Google-funded assessment by Leviathan Security Group concluded Android's built-in, no-cost protections outperform iPhone's across call-screening and fake-call detection, a claim that carries an obvious conflict of interest since Google paid for the study. On the bank-impersonation side, Google cited data from the Brazilian Federation of Banks showing bank-impersonation scams there surged 195.7% over a 12-month period, the backdrop for why Google built its verified-call system with Brazilian banks first before expanding to Revolut and other institutions.

What to watch next

The tradeoff a user is actually accepting by turning Enhanced protection mode on: unknown-sender message content leaves the device and goes to Google's cloud Gemini models for analysis, inside Private AI Compute, rather than staying in on-device processing the way Android's existing scam filters work. Google says that cloud environment encrypts the data and keeps it inaccessible even to Google itself, but a user weighing whether to flip the setting on is weighing that claim, not a no-data-leaves-the-phone guarantee. Whether Google eventually makes that cloud analysis the default instead of opt-in, and how quickly the chat-notification alerts reach non-Pixel Android partners beyond this year's rollout, are the two threads worth checking back on.

Sources