Gemini Nano checks scam links locally on the phone – but for now only on the newest flagship
Google is rolling out a new opt-in mode in Google Messages in which cloud-based Gemini models will assess the intentions of unknown senders, supplemented by a package of Android anti-fraud features. But the device requirements are strict: the cloud-delivered analysis requires a Pixel 6 or newer and the Galaxy S24 series or above, while the Gemini Nano link check only reaches the newest flagship phones.
What's new
On 14 October 2026, during Cybersecurity Awareness Month, Google announced a series of new scam protections for Android. The central news is a new "enhanced protection" setting in Google Messages, which according to The Verge is rolling out "in the coming weeks". The feature's official name is "Scam Detection enhanced with Private AI Compute", and it is opt-in – the user must switch it on themselves.
The model builds on the on-device scam detection in Google Messages that was first launched in March 2025, PCMag writes. What's new is that the cloud comes into play: when the mode is switched on, the local analysis is supplemented with cloud-based analysis powered in Google's Private AI Compute environment.
How it works
The mechanism has two tiers, which work differently depending on your phone:
Cloud-delivered conversation analysis. Google Messages uses cloud-based Gemini models to quickly assess a potential scammer's intentions in conversations with an unknown sender, The Verge reports. Droid Life describes it this way: Google believes its most capable cloud-based Gemini models can look at the most complex message content and then – "hopefully", as the site dares to put it – understand the scammer's intent. Which specific Gemini models are used, the sources do not say; they refer to them only as "most capable" or advanced, without naming them.
Gemini Nano link check. On newer phones with more powerful processors – for example, the Pixel 10 series from last year and the Galaxy S26 series from this year – the opt-in also adds a local layer on top: the on-device Gemini Nano model is to assess links shared in messages to see whether they match scam patterns, even if the addresses are not found in catalogs of malicious websites, PCMag writes. This means the protection can catch new, unregistered phishing links that traditional blocklist filters do not know about.
The privacy claim – a company promise, not a verified fact
Because message content is now sent to the cloud for analysis, privacy is the most important question. Google says user data is encrypted during the AI analysis and "processed in a secure dedicated space" that Google – and everyone other than the user – cannot access, according to The Verge.
It is worth being clear about what this is: a claim from Google about its own Private AI Compute architecture, not something independently verified. The announcement itself is not available in the source record either – all documents are secondary coverage of Google's announcement, and several essentially reproduce the company's own framing.
Which phones get what
The device requirements are one of the story's most important limitations:
- Cloud-delivered conversation analysis in Google Messages: Pixel 6 and up (through the Pixel 11 series), the Galaxy S24 series and up, Galaxy Z Fold 6 and Flip 6 and up, as well as other Android devices that support the AICore system service, Droid Life and PCMag write. PCMag notes that this means phones as old as the Pixel 6 from 2021.
- Gemini Nano link check: only the Pixel 10 series and newer, the Galaxy S26 series, Z Fold 8 and Flip 8, according to PCMag and Droid Life.
In other words: the most advanced protection – local link assessment beyond the blocklists – is reserved for the newest flagships, while older phones must make do with the cloud analysis or the traditional filters.
The rest of the package
The announcement includes several features with different timelines and requirements:
- Link warnings. Revised checkpoints for suspicious links arrive later in October and require only Android 6 or newer, How-To Geek writes – the most accessible items in the package.
- Warnings in third-party chat apps. The scam warning Google added for third-party chat apps in September is being extended to far more manufacturers: HONOR, Infinix, Motorola, OnePlus, OPPO, TECNO, vivo and Xiaomi, according to Android Authority. Google says the existing warnings will come to "hundreds of millions" more devices – again the company's own figure.
- Screen-sharing protection. The automatic concealment of sensitive information such as passwords and payment details during screen sharing is being extended to Chrome and embedded versions of the browser. This feature requires Android 15 from 2024, PCMag writes.
- Protection against call-forwarding fraud. At some point in December, users of "Pixel and other select devices" will get protection against call-forwarding scams: Android will block attempts by apps to capture multi-factor authentication codes via hidden call forwarding, and alert when someone tries to get you to enter a forwarding code in the dial pad, according to PCMag.
The sources differ slightly on timing – "later this month" at Android Authority versus "later in October" at How-To Geek for the link warnings, and "early December" versus "at some point in December" for the forwarding protection. The precise window is thus unclear, but the order is consistent: the Messages feature first, then link warnings, with the forwarding protection last.
Google's own numbers – with caveats
The announcement is wrapped in research and statistics that Google itself commissioned or supplied:
- A report from the analysis firm Leviathan Security Group, funded by Google, concludes that Android's default scam protections are superior to iOS's.
- A YouGov survey of roughly 4,500 smartphone users is cited in the same context.
- Google says Android's banking verification feature in Brazil, launched in June, has already blocked over three million fraudulent calls, according to Engadget.
All of these figures and conclusions are Google's own or from Google-funded research, and they have not been independently confirmed. It is also unclear whether and when the banking verification feature from Brazil will become available outside Brazil.
What remains to be answered
Three questions remain after the announcement. First: how does Private AI Compute work in practice, and what kind of guarantees does "the secure dedicated space" provide technically – a question independent security researchers must assess, not just Google. Second: how well does the cloud model actually perform at interpreting scammers' intentions, particularly for Norwegian and other non-English conversations – the sources say nothing about languages or accuracy. Third: how quickly will the features reach beyond the flagships? The package reveals a clear hierarchy in which the newest and most expensive phones get the most advanced protection, while the broad-reach features – link warnings on Android 6 and the OEM expansion – are what will actually reach most users.