Google Messages gets an opt-in Gemini mode to catch slow-burn scams

Google says mobile scams have grown far beyond basic robocalls and phishing texts. Today's scams use spoofed numbers, fake bank alerts and AI voice cloning.

By the numbers:

• Survey: Google and YouGov asked 4,500 smartphone users in the US, Canada and Australia about scams.
• Worry: 40% said they are "very" or "extremely" concerned about mobile fraud.
• Already flagged: Scam Detection in Phone by Google and Google Messages flags more than 5 million suspected scam calls and texts every month.

Google's argument is simple. With scams this polished, it's nearly impossible for people to spot every red flag on their own, so the phone has to catch them first.

It's a new opt-in setting inside Google Messages. Google calls it its most powerful set of defenses against complex scams, and says it will roll out in the coming weeks. Turning it on unlocks three things:

• Cloud Gemini for tricky chats: Scam Detection can use Google's most capable cloud Gemini models to read the context of a conversation with an unknown sender.
• Smarter link checks: Gemini Nano, the small AI model that runs on your phone, uses real-time web signals to judge links it hasn't seen before.
• Link checkpoints: Redesigned warnings give you more time and context before you tap a link from a number that isn't in your contacts.

The cloud part targets what Google calls slow-burn conversations. These start out friendly and harmless, and the scam only shows up later. It's a bit like a stranger at a party who spends twenty minutes on small talk before mentioning a "great investment."

The catch: BleepingComputer notes that the cloud-based protections are off by default. If you want them, you have to switch them on.

This is the obvious question, and Google answers it directly. The cloud analysis runs in Private AI Compute, which Google describes as an encrypted, secure and dedicated space.

Google says the data stays private to you and inaccessible to anyone else, including Google.

The cloud check only applies to conversations with unknown senders. Your chats with saved contacts aren't part of it. Google also says the cloud analysis adds to the detection that already runs on the phone, rather than replacing it.

gHacks sums up the trade-off well: you get stronger checks, but message analysis moves from purely on-device to the cloud. That's a choice each person can make, which is why the setting is opt-in.

Google Messages already flags links to known malicious and phishing websites. The problem is that scammers keep registering fresh websites that no blocklist has seen yet.

That's where Gemini Nano comes in. With Enhanced protection on, it looks at real-time web signals to decide whether an unfamiliar link is trustworthy before you tap it.

The new warnings for links from unsaved numbers were previously only available in select countries or on phones with Android Advanced Protection turned on. Now they come with the new mode.

In real life You get a text from an unknown number saying your package is stuck and you need to pay a small fee. With Enhanced protection on, Messages checks the link before you tap it and shows a clear warning that gives you a moment to think.

Google first launched Scam Detection in chat notifications on Pixel. It warns you about suspicious messages from popular chat apps right in the notification shade, before you even open the app.

What's next: Google says it is partnering with Android device makers to bring this on-device protection to hundreds of millions more users later this year.

• Named by CNET: Motorola, OnePlus and Xiaomi.
• Listed by gHacks: Honor, Infinix, itel, Motorola, Oppo, OnePlus, Realme, Tecno, vivo and Xiaomi, among other makers.

CNET also points out that the updates matter for former Samsung Messages users. That app shut down in July, and its users were urged to switch to Google Messages.

Some scammers try to redirect your incoming calls to their own number. Once your calls ring on their phone, they can receive the one-time passcodes your bank or email sends by voice, and take over your accounts.

Google is closing two doors here:

• Apps: Android now blocks apps from quietly turning on call forwarding in the background.
• You: If a scammer talks you into typing an MMI forwarding code into your dial pad, Android warns you before it takes effect.

An MMI code is a short string of digits, stars and hashes that changes network settings like forwarding. gHacks has good advice on this one: a stranger asking you to type such a code is a clear sign of a forwarding scam.

The catch: gHacks notes that Google hasn't said which Android versions the forwarding and screen-sharing changes require.

Screen sharing is handy for helping family or working with coworkers. It's less handy when you need to type a password or a card's security code while someone watches.

Android already hides sensitive information in its native apps during a screen share. Google says that protection now extends to Chrome and Android WebView. Login fields and payment screens are blanked out automatically during a live session.

gHacks explains the scam this targets: victims are talked into sharing their screen, then guided step by step through banking apps or websites.

Caller ID spoofing is when a scammer makes a call look like it comes from your bank. Google cites the Brazilian Federation of Banks (FEBRABAN), which says bank impersonation scams in Brazil rose 195.7% over 12 months.

Android's answer is verified financial calls, built with Banco do Brasil, Itaú Unibanco and other banks:

• Real-time check: Working with official banking apps, Android checks whether the bank actually placed the incoming call.
• Fail and you're off: If the caller fails the check, Android hangs up and alerts you.
• Results: Since launching in June, it has blocked more than 3 million spoofed calls for Banco do Brasil and Itaú Unibanco alone.

Many of those calls spoofed inbound-only numbers, official bank lines that never call customers. Google says the feature also protects customers of other institutions such as Revolut, and more partners are coming.

Google also pointed to an evaluation by Leviathan Security Group. Google commissioned it, and it compared built-in scam defenses on Android and iOS.

According to Google, the report found Android offers the strongest out-of-the-box protections, ahead in tools like call screening, fake call detection and Circle to Search warnings. Google also says iPhone users in its YouGov survey were more likely than Pixel users to report falling for a scam. Keep in mind that both studies were paid for by Google.

• Turn it on when it arrives: Enhanced protection is opt-in, so look for it in Google Messages settings over the coming weeks.
• Never type codes for strangers: If someone on a call asks you to dial a code with stars and hashes, hang up. Android will now warn you too.
• Share screens carefully: Chrome now hides login and payment fields during a share, but it's still best not to share your screen with someone you don't know.
• Check the caller yourself: Google and BleepingComputer both advise verifying who is calling before acting on any account request. For more on how phishing networks operate, see our story on Microsoft's takedown of a phishing network.