Mishaal Rahman / Android Authority
TL;DR
- Google is working on a new security feature for Android that blocks you from changing certain sensitive settings during phone calls.
- These sensitive settings include allowing apps to install other apps (i.e. sideloading) and allowing accessibility access.
- Scammers are known to request these kinds of changes during phone calls, which is why Android is going to block them.
Update, February 14, 2025 (04:41 PM ET): After a little more investigation, we’ve discovered that Google’s new in-call anti-scammer protections are already live in Android 16 Beta 2. You can see them in action for yourself in this video demonstration we’ve put together:
Original article, February 14, 2025 (05:00 AM ET): There’s a wide variety of phone scams that you need to be aware of, and with the advent of AI speech tools, these scams will only become more convincing. Scammers will employ all sorts of psychological tricks to get you to send them money or give them access to your online accounts, and unfortunately, many people fall victim to these scams every day. To combat these scammers, Google is working on a new security feature for Android 16 that blocks you from changing certain sensitive settings during phone calls. This will hopefully make it harder for scammers to succeed and make people think twice before installing or enabling malicious software.
You’re reading an Authority Insights story. Discover Authority Insights for more exclusive reports, app teardowns, leaks, and in-depth tech coverage you won’t find anywhere else.
When a phone scammer finds a potential victim, they look for ways they can get the victim to send them money or personal data. Often, this involves tricking them into installing malware and then granting it access to sensitive permissions like accessibility access. The average person probably doesn’t know how to sideload apps on Android, though, which is why the scammer stays on the line to guide them through the process.
This is where Android 16’s new security feature will step in. Android 16 will detect when a phone call is active and then prevent you from enabling the sideloading permission. This is according to strings I discovered while digging through Android 16 Beta 2:
Code
<string name="enhanced_confirmation_phone_state_dialog_install_desc_prefix">Allowing apps to install other apps is not allowed during a phone call.</string>
<string name="enhanced_confirmation_phone_state_dialog_desc">"%1$s
Scammers often request this type of action during phone call conversations, so it’s blocked to protect you. If you are being guided to take this action by someone you don’t know, it might be a scam."</string>The sideloading permission, which allows apps to install other apps, is disabled by default for security reasons, as a lot of malicious software is distributed outside of official app stores. It has to be explicitly enabled by going to Settings > Apps > Special app access > Install unknown apps. Users with Advanced Protection Mode enabled cannot toggle this permission precisely because of the security risks.
Although this feature blocks sideloading during calls, scammers could instruct victims to hang up, sideload the app, and call back. First, this added step introduces friction, which can disrupt the scammer’s flow and cause the victim to become suspicious. Crucially, the dialog displayed when you attempt to enable the sideloading permission warns that scammers often request this action during calls, and it advises caution if being guided by an unknown caller. This warning could make some people reconsider the caller’s legitimacy and prevent them from becoming victims.
What if the sideloading permission is already enabled, or worse, the scammer’s app is on the Google Play Store? Android 16 also blocks the enabling of certain sensitive permissions, such as accessibility access, during active phone calls. Granting accessibility access allows an app to read the screen and perform actions on your behalf—a powerful combination that could give malicious software complete control of your device. This added layer of protection will hopefully reduce the number of successful phone scams.
Code
<string name="enhanced_confirmation_phone_state_dialog_a11y_desc_prefix">Giving an app access to accessibility is not allowed during a phone call.</string>
<string name="enhanced_confirmation_phone_state_dialog_title">Can’t complete action during call</string>These new security features are already live in Android 16 Beta 2, and will presumably still be present for the public release of Android 16 later this year. They build upon the Enhanced Confirmation Mode feature, introduced in Android 15, that makes it harder for sideloaded apps to get access to sensitive permissions.
