OTP Fraud: Solution Found ? Google Introduces Comprehensive Updates to Android 15

With the introduction of AI-driven features, Google is intensifying its efforts to protect Android users against fraudulent activities. 

18 May 2024

By Ishika Kumar

In a significant move to combat fraud and enhance security, Google has announced new AI-powered safeguards aimed at protecting Android users from scams. These updates are set to be rolled out with Android 15 and were revealed during the Google I/O 2024 developers conference. Here’s a detailed look at the forthcoming changes and how they aim to secure user information.

AI-Powered Safeguards Against Fraud

With the introduction of AI-driven features, Google is intensifying its efforts to protect Android users against fraudulent activities. As the company stated, “We’re also bringing additional protections to fight fraud and scams in Android 15 with two key enhancements to safeguard your information and privacy from bad apps.”

These enhancements include:

·        Invisible OTPs: In order to mitigate the risk of malware attacks, one-time passwords (OTPs) will no longer be visible in alerts, except on wearable companion apps. This change closes a significant loophole often exploited by malicious software.

·        Expansion of Restricted Settings: Building on the restricted settings introduced in Android 13, Android 15 will require users to grant additional permissions when installing apps from internet-sideloading sources such as web browsers, chat apps or file managers. This aims to protect sensitive permissions commonly abused by scammers.

Defending Against Social Engineering Attacks

Google is also bolstering defences against social engineering attacks, particularly those targeting screen-sharing functionalities. These new safeguards include:

·        Hidden Notifications and OTPs: During screen sharing, private notification content, including OTPs, will be automatically hidden. This prevents remote viewers from seeing sensitive details, thwarting attempts to steal critical data.

·        Safer Logins: When users input credentials such as usernames, passwords or credit card numbers during a screen-sharing session, the screen will be concealed to protect this sensitive information.

·        Selective Screen Sharing: Users will have the option to share only the content of a specific app instead of their entire screen. This feature, already available on Pixel devices, will soon be extended to other Android smartphones.

Advanced Cellular Security

Android 15 will introduce advanced cellular protections to guard against abuse by criminals using cell-site simulators. These new features include:

·        Cellular Cipher Transparency: Users will be notified if their cellular network connection is unencrypted, which can expose voice and SMS traffic to interception. This feature aims to alert users if they are being targeted by criminals attempting to inject fraudulent SMS messages.

·        Identifier Disclosure Transparency: At-risk users, such as journalists and dissidents, will be alerted if a potential false cellular base station or surveillance tool is recording their location using a device identifier.

These cellular security features will require integration with device OEMs and compatible hardware, with broader adoption expected over the next few years.

Enhancements to Google Play Protect

Google Play Protect, which scans 200 billion Android apps daily, is receiving significant upgrades. The on-device AI capabilities are being expanded with live threat detection to improve fraud and abuse detection. This enhancement will:

1.     Analyse behavioural signals related to the usage of sensitive permissions and interactions with other apps.

2.    Detect suspicious behaviour on the device through Private Compute Core, ensuring user privacy is preserved.

3.   Send apps exhibiting suspicious behaviour to Google for additional review, warning users or disabling apps if malicious behaviour is confirmed.

Manufacturers such as Google Pixel, Honor, Lenovo, Nothing, OnePlus, Oppo, Sharp and Transsion are expected to deploy live threat detection later this year.

Empowering Developers with New Tools

To aid developers in creating safer apps, Google is updating the Play Integrity API. This tool allows developers to verify that their apps are running on genuine, unmodified Android devices and helps detect fraudulent behaviour. Key updates include:

·        Screen Capture Risk Detection: Developers can check if other apps are running that might capture the screen, create overlays or control the device, helping to protect sensitive information.

·        Malware Risk Detection: Developers can ensure Google Play Protect is active and that the user’s device is free from known malware before performing sensitive actions.

·        Anomalous Device Activity Detection: Developers can receive information on recent device activity to identify potential attacks.

Additionally, Google is tightening policies around photo permissions. Starting this year, apps on Google Play must demonstrate the necessity of broad access to photos and videos. The updated photo picker, which now includes support for cloud storage services like Google Photos, will soon support local and cloud search as well.

Ongoing Commitment to User Safety

Google’s commitment to user safety remains steadfast, continuously evolving its multi-layered protections. The company collaborates closely with OEMs, the Android ecosystem and the security research community to build a secure Android experience. These latest updates are a testament to Google’s dedication to staying ahead of fraudsters and bad actors, ensuring that Android users worldwide are protected from emerging threats.

In conclusion, with the upcoming Android 15 release, Google is set to deliver a more secure and user-friendly experience by leveraging advanced AI-powered safeguards and comprehensive security features. These efforts underscore Google’s ongoing mission to provide robust protection against the ever-evolving landscape of fraud and scams.