Google on Thursday revealed that the rip-off defenses constructed into Android safeguard customers all over the world from greater than 10 billion suspected malicious calls and messages each month.
The tech big additionally stated it has blocked over 100 million suspicious numbers from utilizing Wealthy Communication Providers (RCS), an evolution of the SMS protocol, thereby stopping scams earlier than they may even be despatched.
In recent times, the corporate has adopted varied safeguards to fight cellphone name scams and routinely filter recognized spam utilizing on-device synthetic intelligence and transfer them routinely to the “spam & blocked” folder within the Google Messages app for Android.
Earlier this month, Google additionally globally rolled out safer hyperlinks in Google Messages, warning customers once they try to click on on any URLs in a message flagged as spam and step them visiting the possibly dangerous web site, until the message is marked as “not spam.”
Google stated its evaluation of user-submitted stories in August 2025 discovered employment fraud to be essentially the most prevalent rip-off class, the place people trying to find work are lured with pretend alternatives with the intention to steal their private and monetary data.
One other outstanding class pertains to financially-motivated scams that revolve round bogus unpaid payments, subscriptions, and charges, in addition to fraudulent funding schemes. Additionally noticed to a lesser extent are scams associated to bundle deliveries, authorities company impersonation, romance, and technical assist scams.
In an attention-grabbing twist, Google stated it has more and more witnessed rip-off messages arrive within the type of a bunch chat with a lot of potential victims, versus sending them a direct message.
“This shift might have occurred as a result of group messages can really feel much less suspicious to recipients, notably when a scammer features a fellow scammer within the group to validate the preliminary message and make it seem like a legit dialog,” Google stated.
The corporate’s evaluation additionally discovered that the malicious messages follow a “distinct day by day and weekly schedule,” with the exercise commencing round 5 a.m. PT within the U.S., earlier than peaking between 8 a.m. and 10 a.m. PT. The very best quantity of fraudulent messages is usually despatched on Mondays, coinciding with the beginning of the workday, when recipients are more likely to be the busiest and fewer cautious of incoming messages.
Among the frequent features that tie these scams collectively are that they start with a “Spray and Pray” strategy by casting a large internet in hopes of reeling in a small fraction of victims by inducing a false sense of urgency by way of lures associated to topical occasions, bundle supply notifications, or toll expenses.
The intention is to hurry potential targets into performing on the message with out pondering an excessive amount of, inflicting them to click on on malicious hyperlinks which can be usually shortened utilizing URL shorteners to masks harmful web sites and finally steal their data.
Alternatively, scams also can embrace what’s known as as “Bait and Wait,” which refers to a extra calculated, personalised concentrating on methodology the place the menace actor establishes rapport with a goal over time earlier than going for the kill. Scams like romance baiting (aka pig butchering) fall into this class.
 |
| Prime three rip-off classes |
“The scammer engages you in an extended dialog, pretending to be a recruiter or outdated pal,” Google defined. “They might even embrace private particulars gathered from public web sites like your identify or job title, all designed to construct belief. The ways are extra affected person, aiming to maximise monetary loss over time.”
Whatever the high-pressure or slow-moving tactic employed, the top purpose stays the identical: to steal data or cash from unsuspecting customers, whose particulars, resembling cellphone numbers, are sometimes procured from darkish net marketplaces that promote information stolen from safety breaches.
The operation can be supported by suppliers that present the mandatory {hardware} for working cellphone and SIM farms which can be used to blast smishing messages at scale, Phishing-as-a-Service (PhaaS) kits that ship a turnkey resolution to reap credentials and monetary data and handle the campaigns, and third-party bulk messaging companies to distribute the messages themselves.
“[The messaging services] are the distribution engine that connects the scammer’s infrastructure and goal lists to the top sufferer, delivering the malicious hyperlinks that result in the PhaaS-hosted web sites,” Google stated.
The search behemoth additionally described the rip-off message panorama as extremely unstable, the place fraudsters search to buy SIM playing cards in bulk from markets that current the fewest obstacles.
“Whereas it might seem that waves of scams are transferring between international locations, this fixed churn doesn’t suggest scammers are bodily
relocating,” it added. “As soon as enforcement tightens in a single space, they merely pivot to a different, making a perpetual cycle of shifting hotspots.”
“Whereas it might seem that waves of scams are transferring between international locations, this fixed churn doesn’t suggest scammers are bodily relocating,” it added. “As soon as enforcement tightens in a single space, they merely pivot to a different, making a perpetual cycle of shifting hotspots.”
