Loading story…
Google is launching fake call detection on Android to help stop scam calls that use caller ID spoofing and AI voice cloning to impersonate trusted contacts. The feature is rolling out globally this month for devices running Android 12 and later, starting with Pixel phones, and works through Phone by Google with supported RCS services. It is designed to warn users when a caller claims to be someone in their contacts but the call cannot be verified as coming from that person’s device.
The protection uses a silent background verification process in which the caller’s phone sends an encrypted confirmation signal during the call. If that signal is missing, the recipient’s device checks whether the real contact’s phone is actually placing the call and displays an impersonation warning if not. Google said the feature is enabled by default where supported, though users can turn it off in settings, and framed the rollout as a response to growing impersonation fraud that has expanded from consumer scams into business-focused social engineering and caused billions in reported losses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google said the fake call detection capability will roll out globally this month for Android 12 and later devices, starting with Pixel phones. The protection works when both parties use Phone by Google and compatible RCS-based verification is available.
Google announced a new Android security feature called fake call detection to identify impersonation scam calls using caller ID spoofing and AI voice cloning. The feature uses a silent encrypted verification process between devices and is enabled by default when supported Google apps and RCS are in use.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has expanded Android protections that tie a phone number to a device and Google accounts, while also adding **fake call detection** aimed at stopping deepfake-enabled phone scams. Reporting on the new anti-scam feature indicates Android can analyze calls for signs of impersonation and other fraudulent behavior, reflecting Google’s broader push to harden mobile devices against voice-based social engineering attacks. Separate reporting on Android’s phone number verification shows Google verifies that a SIM associated with a number is physically present in a device, then links that verified number to active Google accounts for services including **RCS messaging**, account recovery, emergency features, and anti-scam protections. The process has used hidden SMS messages and now increasingly relies on carrier APIs that exchange encrypted device and SIM-related data; the feature is enabled by default, can generate “number is now verified” alerts, and has raised privacy concerns because one verified number may be associated with multiple Google accounts on the same device.
Jul 22, 2026
Researchers and security practitioners warned that attackers are using widely available AI tools to make social engineering more personalized and scalable. McAfee found that free vision models could infer where travel photos were taken with high accuracy, with **Gemma3 27B** identifying the correct city and country in 87% of tests and **Qwen3 VL 30B** reaching 91%, giving scammers enough location context to craft convincing phishing lures from social media posts. Separate reporting also described how public profiles, posted media, and voice samples can be harvested to build believable impersonation campaigns over phone and audio channels. New research on AI voice phishing found that the effectiveness of scam calls depends more on the **script and persuasiveness** than on whether a voice sounds perfectly human. In a study of 4,100 U.S. adults, suspicion of AI-generated voices was common but detection accuracy was poor, and familiarity with AI tools did not significantly improve performance; across five scam scenarios, 16.5% of participants said they would comply or might comply, while a fake-relative-in-trouble scenario reached 36.1%. The findings indicate that defenders should emphasize **out-of-band verification** and stronger identity-proofing rather than relying on users to spot synthetic voice artifacts or other obvious signs of AI use.
Jul 17, 2026
ESET uncovered a large Android fraud campaign, tracked as **CallPhantom**, that used 28 apps on Google Play to falsely promise access to call histories, SMS records, and WhatsApp call logs for arbitrary phone numbers. The apps were downloaded more than **7.3 million** times, primarily by users in **India** and the wider **Asia-Pacific** region, before Google removed them after disclosure in December 2025. Instead of providing real communications data, the apps generated fabricated records from hardcoded values and displayed deceptive previews to convince users the service worked. The operation monetized victims through multiple payment channels, including **Google Play billing**, third-party **UPI** payment flows, and embedded card-entry forms, with the latter methods violating Google Play policy and making refunds harder to obtain. Researchers said some apps also used fake notifications to drive users back into subscription prompts, while backend infrastructure relied on **Firebase Cloud Messaging** for command-and-control and Firebase databases to manage some payment details. Published reporting also included indicators of compromise such as app **SHA-1 hashes**, Firebase domains, and related IP addresses tied to the campaign.
Jun 29, 2026