Loading story…
Google’s Phone number verification feature, enabled by default on Android, automatically links a device’s phone numbers to every Google account signed in on that device, including accounts added later. The behavior raises privacy concerns for users who keep personal, work, and secondary identities separate. It is not evidence of an account breach, and the reporting does not establish that linked numbers become publicly visible.
Users can disable automatic phone number verification in Android settings, but must separately remove unwanted numbers already attached to individual Google accounts. Some users, including a poster on Reddit’s r/degoogle community, reported that the setting reenabled itself; Android Authority could not reproduce that behavior. Organizations relying on account separation should review phone-number associations on shared or multi-account Android devices rather than assume disabling verification removes existing links.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Between August and October 2025, Google updated its support page to explain that phone-number verification is enabled by default and covers all Google accounts on an Android device, including accounts added later. The documentation change does not establish when the feature launched.
Android Authority staff found automatic phone-number verification enabled on their devices but could not reproduce reports of the setting reenabling itself. They also reported that disabling verification does not remove numbers already attached to individual accounts.
Some Reddit users reported that the phone-number verification setting reenabled itself without their intervention. The behavior remained unconfirmed.
Android Authority reported that users received unexpected emails notifying them that their phone numbers had been verified, raising concerns about links between otherwise separate Google accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has expanded Android protections that tie a phone number to a device and Google accounts, while also adding **fake call detection** aimed at stopping deepfake-enabled phone scams. Reporting on the new anti-scam feature indicates Android can analyze calls for signs of impersonation and other fraudulent behavior, reflecting Google’s broader push to harden mobile devices against voice-based social engineering attacks. Separate reporting on Android’s phone number verification shows Google verifies that a SIM associated with a number is physically present in a device, then links that verified number to active Google accounts for services including **RCS messaging**, account recovery, emergency features, and anti-scam protections. The process has used hidden SMS messages and now increasingly relies on carrier APIs that exchange encrypted device and SIM-related data; the feature is enabled by default, can generate “number is now verified” alerts, and has raised privacy concerns because one verified number may be associated with multiple Google accounts on the same device.
Jul 22, 2026
Google announced expanded Android protections against scam messages, malicious links, bank impersonation and call-forwarding abuse, with rollout underway for eligible devices. An optional **Enhanced Protection** mode in Google Messages uses cloud-based Gemini models to analyze conversations with unknown senders through Private AI Compute, an encrypted processing environment Google says is inaccessible even to the company. Separate link checks combine on-device Gemini Nano with real-time web signals, while notification-based scam alerts are expanding beyond Pixel phones to hundreds of millions of additional Android devices. Android will also extend sensitive-information masking during screen sharing to Chrome and Android WebView, prevent apps from silently enabling call forwarding, and warn users who manually activate forwarding through MMI codes. Google is expanding bank-call verification and says it has blocked more than **3 million fraudulent calls** involving Banco do Brasil and Itaú Unibanco since June. Organizations supporting Android users should account for the Messages feature requiring user activation and verify availability across their device fleets; Google has not specified individual rollout schedules or the Android versions required for the screen-sharing and call-forwarding safeguards.
Oct 17, 2026
Google updated *Google Voice* onboarding so **new users must complete identity verification with government-issued ID** (e.g., passport, national ID, driver’s license) before a newly assigned number can be used for calling or two-way messaging. The change is positioned as an anti-abuse control to reduce “gray market” acquisition and criminal misuse of Voice numbers for spam and other malicious activity, with automated checks, possible manual review, and limits on repeated verification attempts that can result in a number being barred from verification. In Australia, a reported case involving a Victorian teacher highlights how **government ID data (passport number) can be leveraged for account takeover**, including an apparent phone-number transfer (consistent with a SIM-swap/number-port style event) that enabled interception of 2FA codes and subsequent access to bank and superannuation accounts. The incident is discussed in the context of rental application platforms and broader concerns about **over-collection and exposure of sensitive identity documents**, with reporting citing analysis that millions of leasing documents across multiple services may be accessible online without authentication—raising the likelihood of ID data theft that can be reused to defeat identity checks and facilitate financial fraud.
Jun 29, 2026