Android 17 QPR2 just closed a loophole scammers have leaned on for years to hijack incoming bank and verification calls. Google’s fourth beta build, released August 28, 2026, stops apps from silently switching on call forwarding and adds a new on screen warning when someone dials a forwarding code by hand.
The change targets programmatic call forwarding fraud, the trick where a scammer talks a victim through dialing a code like *21# that quietly reroutes every incoming call, including a one time passcode from a bank, straight to the scammer’s own phone.
Anyone who has ever taken a call walking them through “a quick settings fix” is the exact person this update was built to protect.
TL;DR: Android 17 QPR2 Beta 4, released August 28, 2026, blocks apps from silently triggering call forwarding codes and adds a confirmation dialog when someone dials one manually. The change targets scams that reroute a victim’s incoming calls, including bank verification calls, to a scammer’s phone. It is live in beta now, with a broader Pixel rollout expected in Google’s next quarterly feature drop.
How Android 17 QPR2 blocks the call forwarding trick
Android 17 QPR2 restricts the TelephonyManager.sendUssdRequest() API so apps can no longer fire off a call forwarding USSD code using only the standard CALL_PHONE permission, according to Google’s official Android 17 QPR2 release notes.
An app attempting that in the background is blocked outright. It receives a USSD_ERROR_NOT_ALLOWED response instead of quietly succeeding, the same way it would have on earlier Android builds.
Manually dialing that same code still works, but not quietly. Android now shows a system level confirmation dialog before the command runs, giving anyone dialing a forwarding code, whether they typed it themselves or a stranger on the phone is coaching them through it, one extra moment to stop.
Ordinary USSD requests, the kind used for mobile money transfers or balance checks, are unaffected. Google narrowed the restriction to the specific pattern scammers exploit rather than USSD codes as a category.
What actually changes for apps and for users
The distinction that matters here is who is dialing and how. A legitimate carrier app with the right role still forwards calls the way it always has.
| Milestone | Date | Detail |
|---|---|---|
| Android 17 QPR2 Beta 4 release | August 28, 2026 | Adds call forwarding fraud restrictions and confirmation dialog |
| Security patch level bundled with Beta 4 | 2026-08-05 | Ships alongside the fraud hardening change |
| Expected stable rollout | Q4 2026 | Delivered to supported Pixel devices as part of Google’s quarterly feature drop cadence |
For everyone else, the practical difference is small until the moment it is not. Nothing changes about how a phone dials, texts, or receives calls day to day.
The only visible change appears the one time someone, or something running quietly in the background, tries to reroute where calls land. That is by design. Security fixes that people never notice are usually the ones doing their job.
The scam this change is actually built to stop
Call forwarding fraud follows a predictable script. A scammer poses as a bank, a delivery service, or tech support, then walks the victim through dialing a short code that forwards their line.
Once forwarding is active, the victim’s phone stays silent. Every call meant for them, including the one time passcode their real bank sends to confirm a login or a transfer, now rings on the scammer’s device instead.
The victim rarely notices anything wrong until money is already gone. There is no missed call, no unusual notification, nothing that would normally prompt someone to check their settings.
That silence is the entire reason this restriction exists. Google is not adding friction to something people use often. It is adding friction to something almost nobody triggers on purpose.
How this fits the rest of Android’s fraud defenses this year
Android’s call forwarding restriction is not an isolated fix. Android 17 has spent the year narrowing exactly this kind of coercion window, from tighter default app permissions to a mandatory 24 hour wait before installing apps from unverified developers, a delay built specifically to interrupt live phone scam calls.
Google also shipped verified financial calls earlier this year, a feature that checks whether a call claiming to be from a supported bank is real before it ever reaches the user. The call forwarding restriction closes a different door in the same house.
What this means the next time your bank calls
Android’s call forwarding restriction does not require the average person to do anything differently. The protection sits underneath the dialer, invisible unless someone tries to abuse it.
Developers building apps that legitimately manage call forwarding, carrier assistants and business phone tools mostly, need to check for the USSD_ERROR_NOT_ALLOWED callback and route affected flows through the ACTION_DIAL intent instead, letting the user confirm the action manually.
For everyone else, the honest takeaway is smaller than the fraud numbers around it suggest. The restriction will not stop every scam call. It closes one specific, well documented method scammers have used to intercept the exact codes people trust to confirm a login or a call forwarding attempt is real.
