Your next Android phone is about to fight back. Google announced 12 security and privacy upgrades at its Android Show I/O Edition on Tuesday, and the theme is clear: Android is moving from letting you manage threats to killing them automatically.
Google is rolling out verified financial calls, a feature spotted in an APK teardown in April, that automatically ends spoofed banking scam calls before the phone even rings. If Android detects a call claiming to be from your bank is fake, the system hangs up. The feature works by checking with supported banking apps on your device to verify the caller. It launches in the coming weeks on Android 11 and newer devices, with Revolut, Itau, and Nubank as the first partners. The same proactive approach extends to malware. Chrome on Android will now scan APK files for known malware at the moment of download using Safe Browsing, blocking the installation before the file touches your storage.
Google is also upgrading Live Threat Detection with on-device AI that watches how apps behave after installation. If an app secretly forwards SMS messages, abuses accessibility permissions, or hides its own icon to launch malicious activity in the background, the system flags it.
Android 17 introduces "dynamic signal monitoring," which lets Google push new threat-detection rules in real time to counter emerging malware techniques. That rolls out in the second half of 2026 on select devices.
Google is also taking on a threat most phone makers ignore: spyware targeting journalists, activists, and dissidents. Intrusion Logging, part of Advanced Protection Mode, creates encrypted forensic logs stored in the user's Google account.
Amnesty International, which worked with Google on the feature, called it "a fundamental shift in the amount and quality of forensic data available on Android devices." The logs track when a phone was unlocked, what apps were installed, what servers the device connected to, and whether someone connected a forensic tool like Cellebrite. Until now, logs were frequently overwritten, erasing potential evidence. The rollout covers devices running the Android 16 December update or newer.
Advanced Protection Mode is also expanding with USB protection now available on all Pixel devices running Android 16 or higher, with broader device support coming soon. Android 17 adds blocking accessibility service access for non-accessibility apps, disabling device-to-device unlocking, and scam detection for chat notifications.
Physical theft protections are getting a default-on mandate. Remote Lock and Theft Detection Lock, which use sensors to detect snatch-and-grab scenarios and immediately lock the screen, will automatically enable after setup, reset, or upgrade on Android 17 devices.
Google is also expanding these protections to Android 10 and newer devices in Argentina, Chile, Colombia, Mexico, and the UK. The "Mark as Lost" feature in Find Hub gets biometric enforcement in Android 17. Even if a thief knows your PIN, they cannot unlock the device or turn off tracking without your fingerprint or face.
Triggering Mark as Lost also disables new Wi-Fi and Bluetooth connections and hides Quick Settings.
Privacy controls are tightening across the board. Android 17 introduces a temporary precise location button that grants GPS access only while an app is actively open. A new contact picker lets apps request specific contacts rather than your entire address book. Android will also hide one-time passwords from most apps for three hours to prevent credential theft.
Google is tackling fake Android builds with OS verification, launching first on Pixel phones. A public append-only ledger provides cryptographic proof that the system is running an official build.
Android 17 also adds support for Post-Quantum Cryptography, announced in March, and allows carriers to disable 2G networks by default in areas where the technology is no longer maintained.
Most of these features arrive with Android 17, with some rolling out sooner to Android 11 and newer devices. Samsung Galaxy and Google Pixel phones get first access this summer.
