Google is adding and expanding a couple of security-focused features to its Android Messages app from today.
The first of these features is something called “verified SMS,” which involves Google working with “trustworthy” businesses to ensure that text messages they send to customers are clearly labeled as legitimate. This means that when an end-user receives a critical communication from a company, such as a one-time password or appointment confirmation, they will know that the message is definitely from the company –rather than a bad actor who may be trying to phish the user or direct them to a spurious website.
Among the partner companies on board for the launch are Kayak, Payback, Sofi, Banco Bradeseco, and 1-800 Flowers, while Google has also opted two of its own services onto the program: Google Identity Verification and Google Pay.
The core underlying problem this is looking to solve is that when customers normally receive an SMS from a company, there is often nothing to indicate who has actually sent it other than a name that the company itself provides in the message. With verified SMS, Google essentially confirms that a business is who they say they are. When that business wants to send a customer a message, it creates what Google calls an “unreadable authenticity code,” or a message hash, and sends the code to Google. That code is unique to each message, and thus Google matches the code to the registered business and displays the business logo with a “verified” icon.
If the codes don’t match, the message will display a “message could not be verified” alert.
It’s also worth noting here that this feature requires an active data connection. So if you’re phone isn’t connected to mobile internet or Wi-Fi, the app will display: “Waiting for connection to verify sender.”
Google has been working on verified SMS for some time, and the feature first started showing up a few weeks ago in a beta build of the app. From today, it will be rolling out gradually across nine countries, with more to come in the future: the U.S., the U.K., India, Mexico, Brazil, France, Philippines, Spain, and Canada.
Elsewhere, Google has launched a real-time spam detection feature in a handful of countries over the past year, and from today it’s landing widely across the U.S. too
The feature works by detecting phone numbers that aren’t part of a user’s contacts, and warns the user that the message could be spam or contain links to unsafe websites. The company also solicits feedback from the user by asking them to confirm whether a message is spam or not.
This feature could lead to some privacy concerns, given that Google said that it temporarily stores the phone numbers of people / businesses that they are conversing with. This only applies when a number is not in a user’s contacts, however, and Google is quick to note that it doesn’t link any of this stored data with the user. And it also doesn’t read message content. The FAQ page reads:
This data is not linked to you or to identifiers like your name or phone number, which means Google doesn’t know who you’re messaging. Your message content is not seen or stored by Google as part of this feature. Learn more about reporting spam or blocking a number.
It’s also worth noting that both verified SMS and spam protection are on by default, but the user can deactivate these features from within the app’s settings.
The case for SMS
While internet-based mobile messaging apps such as WhatsApp, Telegram, and iMessage are now generally more popular than SMS in many markets, the humble text message still holds key advantages over messaging apps. Indeed, SMS allows users to send messages to anyone who has a mobile phone number, without requiring a proprietary app, and it also works in areas where internet access may be patchy. According to Statista data, 1.5 trillion messages were sent by SMS in the U.S. alone in 2017.
As such, companies are continuing to invest in various SMS smarts, such as Chinese smartphone company OnePlus which recently upgraded its SMS app with AI that categorizes messages and displays content as visual cards.
As for Google, it has thrown resources at Rich Communication Services (RCS), a sort of next-gen SMS system that mimics most of the best features of internet-based messaging apps. Google has also sought to make its Messages app smarter via integrations with Google Assistant.