Scam protection
Checks a message, payment request or caller against known scam patterns, on the device.
- Available
- 05
- Limited
- 09
- Not released
- 03
- Coming
- 03
How the attack works
A scam is social engineering: the attacker does not break into your phone, they persuade you to open the door. The tools are ordinary — a text, a call, a payment request — and the weapon is pressure: urgency, authority, fear of loss or the promise of easy money.
- STAGE 01
Contact
A message, call or marketplace chat that appears to come from a bank, a courier, a government office, an employer or a buyer.
- STAGE 02
Pretext
A believable problem or offer: your account will be blocked, a parcel is held, a refund is waiting, a return is guaranteed.
- STAGE 03
Pressure
A deadline, a threat or secrecy ("do not tell the bank, this is confidential") to stop you from checking with anyone.
- STAGE 04
Ask
Share an OTP, approve a collect request, scan a code, pay a "fee", or install a "support" app that gives remote control of the screen.
- STAGE 05
Cash-out
Money moves to a mule account within minutes; with a remote-access app the attacker can complete the steps themselves.
- Anyone with a UPI or banking app on their phone
- Older relatives who are less used to app-based banking
- Online sellers and buyers on classified and marketplace sites
- Job seekers and people looking for investment returns
A common pattern: a caller claims to be from a bank or a telecom company, says the account or SIM is about to be blocked, and asks the victim to install a screen-sharing or remote-support app "to fix it". Once the app has accessibility access, the caller watches the OTPs arrive and completes transfers while keeping the victim on the line.
Most losses start with a conversation, not malware: a fake bank message, a "KYC update" link, a caller who asks you to install a remote-support app, or a UPI collect request you did not expect.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
Remote-access app inventory
The phone checks installed apps against 12 known remote-control packages and whether one holds accessibility access.
AvailableAndroid 4.50Posture scoring
An active remote-access app adds 50 points (critical); installed only adds 15. A total of 45 or more is a high risk level.
AvailableHub, productionRed flags with reasons
Paste-in message and payment checks list each red flag they found — urgency, lookalike brand, OTP request — instead of a bare score.
AvailableAndroid 4.50Warn, then optional lock
The app warns. On a high or critical score the hub can queue a device lock (on by default, can be turned off); wipe is off by default.
LimitedHub + Android 4.50
Checks run on the phone. The text you paste is not uploaded.
A result lists the red flags it found (urgency, lookalike brand, request for OTP), so you can judge it yourself.
A check gives a risk level with reasons. It is not a guarantee that a message is safe.
What works today, and what is coming
What works today
14In production or in the current download.
- Remote-access app warningAvailable
Flags known remote-control apps and warns when one holds Accessibility control.
Android app 4.48
- Check a messageAvailable
Paste an SMS, WhatsApp or e-mail text, or share it to Sentinel from any app; get red flags and a risk level. Checked on the phone; nothing is opened or sent.
Android app 4.48
- Payment and UPI scam checkAvailable
Looks for collect-request, refund and "pay to receive" patterns in a payment request.
Android app 4.48
- Impersonation, investment and marketplace checksAvailable
Pattern checks for fake officials, guaranteed-return schemes and advance-payment sellers.
Android app 4.48
- Hacked social account helpAvailable
Recovery checklists for WhatsApp, Telegram, Instagram and Facebook, a look-alike WhatsApp check and a "messages I did not send" guide. Guidance only: Sentinel cannot read your chats or linked devices.
Android app 4.48
- Phone takeover protectionLimited
Lists apps that hold Accessibility, draw-over-apps, notification-access or device-admin powers and records when a new power appears. It warns and opens the right Settings page; it never switches anything off. A new Accessibility or notification-access power is noticed within about a second while protection runs; a new device administrator is only found by the periodic check, because Android sends no signal for it. Overlay changes were checked on a real phone; Accessibility, notification-access and device-admin signals have not been.
Android app 4.48
- Money ShieldLimited
One place in the Protect tab for money-fraud help: UPI Shield (payee, name, amount and note checked for warning signs, look-alike merchants), QR Shield, Scam Message & Call Shield, Remote Control Shield, Fake Banking App Shield, SIM / Identity Shield, payment verification by calling back a saved number, Recovery Center guides and NFC card guidance. It gives risk warnings only. There is no link to any bank, NPCI or telecom operator, so it cannot confirm that a payee is genuine or that money is safe, and it cannot reverse a payment. Each part is marked Live, Partial or Guidance only in the app.
Android app (from 4.47)
- Payment safety and call-context modeLimited
A warning (never a block) when a payment app is open while another app can control the phone or draw over it. An optional call-context mode, off by default and asking for the Phone permission only when turned on, raises the warning if a new powerful permission appears during or just after a call; it reads only whether a call is active, never audio, numbers or contacts. Android does not tell apps when another app is sharing the screen, so screen sharing itself is not seen; the app looks at the powers apps hold instead. Not yet tried on a real call.
Android app (from 4.47)
- Fake banking and popular-app checkLimited
A local, versioned list (21 bank and payment apps, 15 with official package names, plus popular apps such as WhatsApp and Truecaller) flags an app whose name or package imitates one. The list is partial: an app not on it is never reported. The signing certificate check shows "Not available": no reference signer is configured, so an app is never called genuine.
Android app 4.48
- Malicious keyboard checkLimited
Lists the enabled keyboards and flags one installed from outside a store or one that also holds Accessibility. A risk warning only: Sentinel cannot see what a keyboard does with the keys. Keyboards installed but not switched on are not listed; not yet tried on a real phone.
Android app 4.48
- Clipboard check on tapLimited
Checks the text you copied only when you press the button, because Android 10 and later block background clipboard reading. It also lists apps that hold Accessibility, the main way an app can still read the clipboard.
Android app 4.48
- Opt-in message help: pick a message to checkLimited
Off until you agree on a consent screen. Then the app asks for the SMS permission and lists the 30 newest messages so you can tap one to check it, on the phone. Nothing is read in the background and nothing is uploaded; Turn off and forget removes it. WhatsApp and other chat apps cannot be read. Not yet tried on a real phone.
Android app 4.48
- Opt-in call screening for unknown callersLimited
Off until you turn it on and give the call-screening role. For a call from a number not in your contacts it checks the number against local rules (premium, international, spoof-like patterns, numbers you reported) and shows a "Possible scam caller" notice. It sees the number only, never the audio, and cannot judge what is said. Not yet tried on a real call.
Android app 4.48
- Check a phone numberLimited
Format and pattern checks only; the newer reviewed-list and consented-report implementation is listed separately as Not released.
Android app 4.48
Built, not yet released
03The code exists and is tested in the repository; it has not shipped to users.
- Call-forwarding indicatorNot released
Reads the indicator Android exposes, with Phone permission. Other SIMs and forwarding rules may be unknown. Carrier codes only open the dialler; no code is sent automatically.
- Reviewed number reportsNot released
Consented reports and an expiring signed, reviewed number list for optional call screening. Contacts and personal allow-lists are exempt. No match does not mean safe; call audio is never analysed.
- App signer observationsNot released
Opt-in package and signer observations, private to the family or organisation. Small groups are suppressed. A mismatch needs reviewed reference data; a count never proves an app genuine.
Coming
03Not built yet. Nothing on this list runs today.
- Automatic SMS screeningComing
Reading every incoming message without you picking it. Not built: Android and the Play policy restrict apps from reading other apps' messages, so checks stay paste, share or pick-one-message.
Android
- Warnings based on what is said in a callComing
We will not record or intercept calls and cannot hear them. Only the opt-in number check above exists.
Android
- Scam centre in the web portalComing
Link, QR, phone and UPI checks from a browser.
Web portal
4 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 040 | Remote Support Scam | Partial | The phone reports 12 known remote-control apps; an active one adds 50 points to the posture score, installed-only adds 15. Fixed list; no automated test of the scoring.Production + repository |
| 035 | Smishing | No sensor | No SMS or link check found in the Android code the register reviewed.Nothing runs |
| 036 | Vishing | No sensor | No call telemetryNothing runs |
| 100 | Payment / UPI Fraud | No sensor | No payment or UPI telemetryNothing runs |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- The text you paste into a message or payment check
- Pattern matching for scam red flags
- Your list of installed apps
May reach the cloud
- The posture score and its reasons (for example "remote-access app active"), from an enrolled phone
- Remote-access findings, mapped to events on your account's timeline
Never leaves
- Message contents
- Call audio — calls are not recorded or intercepted
- OTPs, PINs and payment credentials
Editions that include it
Android protection you can install today.
> Android phone owners
Local-first protection for your own computer and phone.
> One person, 1–3 devices
One summary for the whole household, without reading anyone's phone.
> Households with supported paired phones
Provider interfaces for chosen-media checks and email exposure monitoring.
> Individuals who want the advanced checks
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
Someone on a call asks you to install an app
- 1.Hang up. Real banks and telecom companies do not ask you to install remote-support apps.
- 2.If you already installed one, turn off its accessibility access, then uninstall it.
- 3.Call your bank on the number printed on your card and ask them to watch the account.
You approved a collect request or shared an OTP
- 1.Call your bank's fraud line immediately; speed matters more than anything else.
- 2.In India, report on the national cybercrime helpline 1930 or at cybercrime.gov.in.
- 3.Change your UPI PIN and banking password from a device you trust.
A message says your account will be blocked
- 1.Do not use any link or number in the message.
- 2.Open your bank's app yourself, or call the number on the back of your card.
- 3.Paste the text into the message check to see which red flags it carries (Android 4.2, not yet released).
Limits and known gaps
- GAP-01No automatic SMS screening. The message, payment and impersonation checks run on text you paste in or share to Sentinel, or on one message you pick after switching on the optional "pick a message" help (it needs the SMS permission and lists only the 30 newest). They are in the Android app 4.48. WhatsApp and other chat apps cannot be read.
- GAP-02Money Shield gives risk warnings only. There is no link to any bank, NPCI or telecom operator, so it cannot confirm that a payee is genuine, cannot reverse a payment and never says "bank-confirmed". The bank-app signer check shows Not available because no reference signer is configured.
- GAP-03Android does not tell apps when another app is sharing the screen, so Sentinel cannot see screen sharing itself. It looks at the powers apps hold (Accessibility, draw over apps, notification access, device administrator) and warns when a payment app is open at the same time. A new device administrator is only found by the periodic check.
- GAP-04Optional call-context mode (off by default) reads only whether a call is active and raises the warning when a new powerful permission appears during or just after a call. Optional call screening checks the number of an unknown caller. Neither hears the call, and neither has been tried on a real call yet.
- GAP-05The remote-access list is a fixed set of 12 packages. A remote-control app not on the list is not flagged, and remote tools on a computer are not detected.
- GAP-06The scoring that uses the remote-access findings runs in production; the Accessibility, notification-listener and device-admin signals have not been tested on a real phone that holds such an app.
- GAP-07Sentinel never analyses call audio. New source work adds consented number reports and signed reviewed lists; it is marked Not released pending release checks. No match is not proof of safety.
- GAP-08The coverage register records smishing, vishing and payment/UPI fraud as not observable: it found no SMS, call or payment telemetry in the code it reviewed. Paste-in checks are not counted as sensors.
- GAP-09No automated test covers the posture scoring that drives the remote-access warning.
Frequently asked
Does the app read my SMS or WhatsApp messages?
Can it block a scam call?
If the check says "low risk", is the message safe?
Why would my phone lock itself?
Capabilities that work alongside it
Checks a link before you open it and warns about lookalike domains.
Decodes a QR code and checks where it really points before you pay or open it.
A file check and guidance only. No detection engine runs, so Sentinel never says whether media is real or fake.
A risk score built from real device signals: root, screen lock, encryption, risky apps.