Android security is moving from scanning to behaviour
Android 17 expands Google's effort to detect scams while they are happening, not only before an app is installed. The change matters because malicious software often looks harmless at first. It may wait, hide its icon or abuse permissions only after the user has granted access.
Google calls the new approach dynamic signal monitoring. The system watches for suspicious patterns in how apps interact with Android, including hiding an icon, launching unexpectedly in the background or misusing accessibility permissions. Rules can be updated as new scam techniques appear.
The feature is expected to roll out on Android 17 devices during the second half of 2026. Availability may depend on the manufacturer, device model, region and Google Play system updates.
Stronger warnings for risky app behaviour
Live Threat Detection already uses on-device signals to identify apps that begin acting dangerously. The 2026 expansion adds warnings for behaviours such as SMS forwarding and deceptive accessibility overlays.
SMS forwarding is especially sensitive because text messages may contain one-time passwords, account recovery links and banking alerts. An app that quietly forwards messages could expose information even when the user never types it into the app.
Accessibility services are powerful by design. They help people operate a device, but a malicious app can abuse the same access to read screen content, cover trusted buttons or trigger actions. Android 17's Advanced Protection mode restricts accessibility-service access for apps that are not labelled as accessibility tools.
Verified financial calls
Spoofed caller ID allows criminals to make a call appear as if it came from a bank. Google's verified financial calls feature is designed to let a participating banking app confirm whether the institution is actually calling.
If the installed bank app says no call is being made, Android can end the suspected spoofed call. Banks may also identify numbers that are used only for inbound calls; an incoming call claiming to originate from one of those numbers can be blocked directly.
The early rollout covers selected institutions and Android 11 or newer, so it is not limited to Android 17. It will only work when the financial institution participates and the user is signed in to the relevant app.
Users should still follow a simple rule: never share an OTP, card PIN or full banking password on an incoming call. If uncertain, end the call and use the number printed on the bank's official website or card.
Chat scam detection and Advanced Protection
Android 17 integrates scam detection for chat notifications into Advanced Protection. This mode is intended for people at elevated risk—journalists, public figures and others targeted by sophisticated attacks—but ordinary users can benefit from its stricter defaults.
Google is also disabling device-to-device unlocking and Chrome WebGPU support while Advanced Protection is active. These restrictions may reduce convenience or compatibility, but the purpose of the mode is to shrink the attack surface.
USB protection is available on Pixel devices running Android 16 or newer, and Intrusion Logging is rolling out more widely. Intrusion Logging creates privacy-preserving forensic records that can help specialists investigate a suspected compromise.
Theft protection improvements
A stolen unlocked phone can expose payment apps, messages and saved credentials. Google's security work includes stronger Failed Authentication Lock controls and broader Identity Check coverage. These tools aim to lock sensitive actions behind biometrics or stronger verification when behaviour or location looks unusual.
No software feature replaces physical caution. Use a strong screen lock, hide sensitive notification content and enable remote-finding features before a phone goes missing. Account recovery details should be kept current on another trusted device.
What users should do now
- Install Android and Google Play system updates promptly.
- Remove apps that no longer need accessibility, SMS or notification access.
- Keep Play Protect and Chrome Safe Browsing enabled.
- Turn on theft protection and Find Hub before an emergency.
- Treat unexpected financial calls and urgent OTP requests as suspicious.
- Consider Advanced Protection if targeted attacks are a realistic risk.
Android 17 improves the operating system's ability to intervene, but security remains a layered process. The best result comes from safer defaults, current software and a user willing to pause before approving an unexpected request.
Visit our Technology section for more security and device coverage. Our UPI payment limits explainer covers another area where account safety and transaction rules meet.
Feature rollout varies by device and region. Check the manufacturer and Google support pages for exact availability.
