Google Adds AI-Powered Android Security Features in 2026 to Block Scams, Theft and OTP Theft

Google has released a substantial set of AI-powered security enhancements for Android, positioning the update as a significant step forward in proactive mobile defence at a time when phone-based fraud and scam activity continue to cause billions of dollars in losses globally each year. The new capabilities span threat detection, device protection, privacy controls and one-time password security, and they are designed to act before harm occurs rather than respond after the fact.

The announcement is directly relevant for enterprise security teams and IT professionals managing mobile fleets across the MENA region. The UAE has one of the highest Android market penetration rates in the world, and phone-based fraud, including spoofed bank calls and SMS phishing targeting financial credentials, is a documented and growing threat across GCC markets.

Live Threat Detection and expanded app monitoring

At the centre of the update is an enhanced version of Live Threat Detection, which uses on-device artificial intelligence to analyse app behaviour in real time and alert users when an application begins acting suspiciously. Google is expanding this system to identify a broader range of harmful behaviours, including SMS forwarding, where an application silently routes messages to a third party, and accessibility overlay abuse, where an app uses granted permissions to display deceptive content over the device screen.

Dynamic signal monitoring is also being introduced on Android 6 devices, tracking how applications interact with the operating system to identify abusive behaviours early. For Chrome on Android, a new protection layer checks an application's package identifier against a malware database before a download completes, reducing the risk of users unknowingly installing harmful software.

Stronger device protection when a handset is lost or stolen

Android 16 introduces a significant upgrade to the Find Hub's Mark as Lost feature, which now requires biometric authentication to unlock a device that has been reported as lost. This closes a meaningful security gap: previously, a thief who had observed a user's PIN or password could unlock a device even after the owner had flagged it as missing. The biometric requirement makes this route of access effectively redundant.

OTP protection receives a dedicated layer of defence. Scammers have increasingly used applications with SMS permissions to read and exfiltrate one-time passwords in real time. Android now automatically hides these security codes from the majority of applications for three hours after they are received, ensuring they remain protected while still active but inaccessible to unauthorised apps.

More precise location controls

Android 16 also introduces a location button that allows users to share their precise location temporarily, only while a specific application is open. This removes the requirement to grant permanent location permissions for tasks that only require momentary access, such as locating a nearby business or service. A persistent location indicator at the top of the screen will appear whenever any application is actively accessing location data, consistent with the existing camera and microphone indicators that Android already displays.

Implications for enterprise and B2B security

For IT and security professionals managing Android device fleets in corporate environments, these updates address several categories of risk that have been difficult to manage through traditional mobile device management tools alone. The app behaviour monitoring extensions target classes of malicious activity, particularly SMS forwarding and overlay attacks, that have been commonly used in mobile banking fraud and corporate credential theft across the Gulf region.

The OTP protection change is particularly significant for organisations where employees use personal Android devices to receive authentication codes for corporate applications. Silent OTP exfiltration has been a known attack vector for some time, and an operating system-level control that hides these codes from unauthorised applications represents a meaningful reduction in risk for BYOD environments. Organisations looking to move beyond OTP-based authentication entirely may also wish to review the shift toward enterprise passkeys, which eliminates the SMS authentication vector altogether.

Google stated that its focus for the remainder of 2026 is on making these defences more seamless and extending them across more device types and Android versions. For enterprises and security teams in the UAE and broader GCC, the practical recommendation is to ensure managed device policies are updated to reflect the new capabilities as they become available across the Android device estate.