Photo by Markus Winkler on Unsplash
Pick up any Android phone on your team's desk and there is a good chance it is doing things you would not expect. Booking meetings, approving invoices, confirming bank transfers, receiving one-time passcodes for your business accounts. It is not just a phone any more. It is a key to a lot of things that matter.
Which is exactly why it attracts so much criminal attention.
Google has just rolled out a set of AI-powered security features in Android that target three specific attack types that have been causing real damage to real businesses: scam calls, phishing links in messages, and the theft of one-time passwords (OTPs). These are not theoretical threats. They are the methods being used against UK businesses right now, and they tend to work best against people who are busy, distracted, or simply not expecting it.
What the new Android features actually do
The scam call detection works by listening to the pattern of a live call and flagging it when the conversation starts to follow the kind of script that fraudsters use. That includes artificial urgency, requests for codes or payments, and impersonation of authority figures like HMRC or a bank fraud team. It runs locally on the device and does not record or transmit what is being said.
The phishing link protection looks at URLs arriving in text messages and messaging apps and checks them against known malicious sites. If something looks dangerous, it warns the user before they tap through.
The OTP protection is perhaps the most technically meaningful of the three. One-time passcodes sent by SMS are increasingly intercepted by malicious apps that have found their way onto a device. The new protection restricts which apps can read incoming codes in the background, cutting off a route that has been widely used in account takeover attacks.
Why this matters if your team uses Android phones for work
Most UK small businesses do not have a formal mobile device policy. Phones get used for work because it is convenient, not because anyone sat down and decided what should and should not be on them. That is understandable. But it does mean that the security of those devices has largely been left to defaults and whatever the network provider bundles in.
These new Android features raise that baseline. They are on by default for supported devices, which means your team gets some meaningful protection without needing to configure anything. That is a genuine improvement worth knowing about.
But it is worth being clear about what they do and do not cover. They are built to catch common, recognisable attack patterns. A scam call that does not follow the usual script, a phishing link on a brand new domain that has not yet been flagged, or an OTP attack using a method that has not yet been seen in the wild are all harder to catch. The features help. They are not a substitute for everything else.
The OTP problem deserves a closer look
One-time passcodes sent by SMS have become the default second factor for a huge number of business accounts. Banking, email, accounting software, cloud storage. When a staff member's phone is compromised and an attacker can read those codes as they arrive, multi-factor authentication stops doing what you thought it was doing.
Restricting which apps can read incoming OTPs is a useful step. It is also a reminder that the type of second factor you use matters. Authenticator apps and hardware keys are harder to intercept than SMS codes, and for anything protecting sensitive business data, they are worth prioritising.
If your team is still relying on SMS for everything, your identity and access setup is worth reviewing. Pairing a password manager with app-based authentication is a meaningful upgrade that costs very little to put in place.
What these features do not cover
No software feature catches everything, and that is not a criticism of Google's work. It is just how security works in practice. Scam calls that come from someone your employee already trusts, phishing messages that arrive through a platform Android is not currently scanning, or a device that has not yet received the update carrying these features are all live risks that remain.
The most reliable protection against socially engineered attacks is still a team that knows what to look for. As we wrote recently in AI Scams Now Sound Like People You Know, the calls and messages arriving in inboxes have become substantially more convincing in the past year. Technical filters help, but security awareness training is what turns your team into a genuine line of defence rather than a point of vulnerability.
There is also the question of which Android version your team is running. These features are tied to specific Android releases and the version of Google Play Services on the device. An older handset or one that has not been updated recently may not have them yet. It is worth checking, particularly if staff are using personal phones for work.
A practical note on mobile devices in your business
If phones are being used to access business accounts, approve payments, or receive authentication codes, they deserve a bit more attention than purely personal devices. That does not mean a complicated management system rollout. It means a short, honest checklist: are devices being kept up to date, is there a screen lock in place, are work accounts separated from personal ones where possible, and does the team know what a scam call sounds like?
The new Android protections are a welcome step. They will stop some attacks that would otherwise have succeeded. The businesses that do best with mobile security tend to be the ones that treat those features as part of a wider picture rather than a complete answer in themselves.
If you want to check where your business currently stands across devices and access controls, get in touch and we can talk through the options.