Google outlines Android’s 2026 security and privacy roadmap (banking scam calls, threat detection, theft protections)

Original post (source): Google Security Blog - “What’s New in Android Security and Privacy in 2026” (May 12, 2026)

• https://blog.google/security/whats-new-in-android-security-privacy-2026/

Summary

Google has published a forward-looking roundup of Android security and privacy changes landing through 2026. It is written for a broad audience, but there are a few practical takeaways for app teams.

1) “Verified financial calls” to cut banking scam spoofing

Google describes a new anti-scam feature aimed at phone call spoofing, where scammers impersonate banks.

How it is meant to work (at a high level):

• When you get a call that appears to be from a participating bank, Android can ask the bank app to confirm whether the bank is actually calling.
• If the bank app confirms it is not calling, Android can end the call.

The post says rollout starts on Android 11+ with select banks, then expands.

2) Expanded Live Threat Detection and more download-time checks

Google says it is expanding Live Threat Detection (on-device AI) to warn about behaviors that can enable scams, including:

• SMS forwarding behavior
• Accessibility overlay abuse

It also mentions “dynamic signal monitoring” on Android 17 to spot suspicious interaction patterns, plus an added layer of safety in Chrome on Android when downloading APKs (if Safe Browsing is enabled).

3) Advanced Protection gets stricter defaults (Android 17)

Google positions Advanced Protection as a “single toggle” for stronger safeguards, and notes upcoming changes including:

• tighter handling around accessibility services for non-accessibility apps
• additional scam detection signals
• planned Android Enterprise support so orgs can enforce it for managed devices

4) Theft protections expand, including stronger lock flows

The post calls out ongoing work on theft protection. One highlighted change: enhancing Find Hub’s “Mark as lost” flow in Android 17 with a biometric requirement (not just a passcode) for certain actions.

Why this matters for app teams

• Accessibility permissions and overlays stay in the spotlight. If your app uses accessibility for legitimate reasons, expect more user suspicion, more OS scrutiny, and more support questions.
• Security UX is part of retention. When platforms add scam and theft defenses, user expectations shift. “This feels sketchy” becomes a churn reason.
• Enterprise and regulated environments get stricter by default. If you sell into business users, platform-level protection modes can break edge-case flows unless you test them early.

What to do next (tiny win)

Pick one flow where your app asks for a sensitive capability (accessibility, SMS, call, device admin, etc.), then:

• rewrite the permission rationale in plain language,
• add a just-in-time prompt (not on first launch),
• and sanity-check the flow with Android’s strongest protection settings turned on.

Read the original: https://blog.google/security/whats-new-in-android-security-privacy-2026/