Google Messages knows when someone impersonates your friends

Google Messages is one of the most popular messaging apps on Android, as it’s not only preinstalled on most devices as the default option but is also the only app that supports RCS messaging with iPhone users. Because it’s so popular, it’s a prime target for hackers, scammers, and spammers looking to steal your personal data, your money, or both. To better protect you from these threats, Google is announcing five new security features that will keep you safe while using Google Messages on Android. These new features augment the app’s existing, built-in spam protection feature to protect you from new threats that have recently grown in popularity.

First, Google Messages is rolling out enhanced detection of package delivery and job scams. Texts about package delivery alerts and job seeking inquiries might seem harmless at first, but they’re often from spammers who are trying to get personal information from you so they can defraud you. Starting today, an enhanced, on-device scam detection algorithm that detects these kinds of texts is rolling out to Google Messages beta users who have spam protection enabled in settings. When the app detects a potential scam text, it’ll automatically move it to your spam folder or warn you about it.

Next, Google Messages will offer intelligent warnings about potentially dangerous links. The app will warn you when you get a link from an unknown sender as well as block messages with links from suspicious senders. As part of a pilot program, Google made this feature available to users in India, Thailand, Malaysia, and Singapore already, but the company says it’s in the process of expanding it globally later this year.

To protect you from scam texts originating from international numbers, Google Messages will let you automatically hide messages from international senders who aren’t in your contacts list. If you enable this feature, then these messages will be automatically moved to the “Spam & blocked” folder. We previously spotted evidence of this feature in an APK teardown last month, so it’s good to see we didn’t have to wait long for Google to announce it. However, the feature will only roll out as part of a pilot program in Singapore later this year, after which Google will “look at expanding [it] to more countries.”

Sensitive Content Warnings is another new Google Messages feature that Google is announcing today. It’s a feature that gives you more control over seeing and sending images that may contain nudity. Sensitive Content Warning blurs images that may contain nudity before viewing them, and it then prompts you with a “speed bump” that contains “help-finding resources and options, including to view the content.” When it’s enabled and you try to send or forward an image that may contain nudity, Google Messages will also show a “speed bump” that reminds you of the risks of sending nude imagery.

Google says Sensitive Content Warning runs entirely on-device and doesn’t break end-to-end encryption in RCS chats. It’s optional for adults but is opt-out through Android Settings for users who are under 18. It’ll be rolling out to devices running Android 9 or later, including to devices running Android Go Edition with 2GB of RAM or more, in the coming months.

Lastly, Google has announced a new contact verifying feature that’ll make it harder for attackers to impersonate one of your contacts. This feature will let you verify your contacts’ public keys so you can confirm you’re communicating with the right person. The company says it’s creating a “unified system for public key verification across different apps” that you can verify through QR code scanning or number comparison. This feature is launching next year for devices running Android 9 or later with support for messaging apps like Google Messages.

Google’s new contact verifying feature sounds similar to the Contact Key Verification feature Apple added in iOS 17.2. It also sounds similar to the Contact Keys feature we spotted a few months ago in a teardown of Google Contacts, but in our teardown, we thought it would require new APIs introduced in Android 15. If Google found a way to backport this feature, that would be great news!

Although Google announced these features today as part of cybersecurity awareness month, most of them aren’t available right now. While the enhanced detection of package delivery and job scams feature is rolling out now, the rest of the new features are either only rolling out in select countries or are slated to arrive in the coming months.

Hopefully Google rolls these new features out to everyone soon, because according to the company itself, over a billion people use Google Messages to communicate every day. Google says that its “powerful on-device, AI-powered filters and advanced security” already protects users from 2 billion suspicious messages a month, but fighting spam is a never-ending cat-and-mouse game that requires constant vigilance. If that wasn’t the case, then none of the features that Google announced today would be needed, but they are necessary and it’s only likely that additional protections will need to be added down the line to address new, emerging threats.