You Can Now Use 'Verified SMS' and 'Spam Protection' on Your Android Messages App

If you think about it, the online threat landscape is, for all intents and purposes, nothing more than a cat and mouse game played by cybercriminals and software vendors' security teams. Here's an example. Some time ago, crooks found out that they can use SMS messages to pull off their scams, and they've been doing it ever since. The ancient technology behind text messages lets them fool users more easily, and the fact that businesses often use this method of communication when reaching out to consumers gave birth to threats like smishing. In an attempt to catch up and stop this type of criminal activity, Google introduces a couple of new additions to Messages – the default app for reading and sending text messages on Android mobile phones.

The features are called Verified SMS and Spam Protection, and eligible users who keep their automatic updates on should soon find them in the advanced section of the Messages app's settings. But what do these new features do?

Verified SMS

Verified SMS is by far the more interesting of the two new additions. It's a bit like the blue tick badge on social media profiles of celebrities and people with large followings. Businesses will register and be verified by Google, and when consumers receive a message from them, the text will appear with a logo and a verified badge. This is supposed to help users sort the genuine SMSs coming from real businesses from the scam texts trying to cause harm. Registering your company for Verified SMS will apparently cost you nothing, and users will also get the feature for free. It doesn't require any additional steps, and it doesn't slow down the communication in any way, which makes the concept all the more appealing. There are a couple of privacy concerns that need to be answered, though.

Does Google know what sort of messages you've received? Is the internet giant going through all your SMSs?

Thankfully, the answer is no. The support page dedicated to the new feature doesn't go into too many details, but it does say that when a verified business wants to send you an SMS, it uses a public key for your device, a private key that nobody can access, and the content of the message to create "an unreadable authenticity code", which is sent to Google. When the message arrives on your phone, the same code is generated, and Google checks it against what it has received from the sender. If there's a match, the message is verified, and the business' logo appears. It seems like an overly complicated process, but it does mean that a spoofed phone number can't fool the system. Crucially, it also ensures that Google won't see the content of your SMSs.

Spam protection

Spam Protection is the second feature that is being rolled out. According to ZDNet, it has actually been available in a few countries for a while, but it should now be accessible to US users as well.

When Spam Protection is turned on, the Messages app displays a warning every time it thinks that the SMS you're trying to view has the classic markings of a spam text. Once again, the feature works without sending the messages to Google's servers, and the user has the ability to report new scams as well as false positives.

Can these new features completely eliminate the threat of scam SMSs?

We wouldn't bet the farm on it. For one, it will be some time before the Verified SMS feature becomes available worldwide. At the moment, it's rolled out in just nine countries: USA, UK, Brazil, India, Mexico, Philippines, France, Spain, and Canada, and Google hasn't provided guidance on when the feature will become available in other parts of the world.

There are still some unknowns around what sort of vetting process businesses will have to go through in order to get their names on the list of verified companies as well. What we do know is that Google's track record when it comes to keeping the bad guys out isn't exactly spotless, especially when it comes to the Android ecosystem. As for the Spam Protection feature, it's little more than a spam filter, and unfortunately, spam filters in general are not perfect.

All in all, it's still too early to predict how effective these two features will be. One thing we can say with absolute certainty is that the cybercriminals will try to find a way around them. This is the nature of the cat and mouse game they've been playing for so long.