Google will implement new restrictions on app sideloading on Android from the second half of 2026, with a focus on combating fraud that exploits users through pressure and threats during app installations outside of official stores. The measure introduces a stricter authentication process for developers, limiting installations of unverified apps, but maintains an advanced option for experienced users. The “enhanced flow” requires a 24-hour wait, device restart, and security confirmations to prevent scammers from forcing victims to ignore alerts during active calls. The initiative especially addresses common cases in Ásia, where fraudsters simulate unauthorized access to induce malicious installations.
The change is part of updates to the Google Play Developer services, scheduled for August 2026 in all versions of Android. Desenvolvedores will need more robust verification before distributing apps, while regular users will have sideloading blocked by default on unauthenticated apps. Google highlights that the design prioritizes protection against manufactured urgency scenarios, in which scammers maintain continuous contact to prevent the victim from seeking help or reflecting on the risks.
Security measures in advanced flow
The process starts with activating developer mode in the device settings. The user then explicitly confirms that they do not follow directions from suspicious third parties. The device restarts to stop any remote access or calls in progress.
After restart, a mandatory 24-hour wait begins, during which biometric or PIN authentications are periodically required. Essa pause aims to break the cycle of pressure exerted by fraudsters. At the end of the period, the app can be installed with a clear warning of unauthenticated origin.
Permission and installation options
During the final installation, the system displays an alert about an app from an unverified developer. The user can proceed by selecting “Install Anyway”. Permissões granted include unlimited or temporary seven-day options, allowing greater control over access.
The advanced stream remains accessible without additional costs or official document requirements. Desenvolvedores can create limited distribution accounts to share apps with up to 20 people, facilitating controlled testing and use without compromising overall security.
Context of the frauds combated
Scammers often call claiming security problems with the victim’s account, such as improper access or financial risks. Eles create urgency with threats of monetary loss, legal complications or harm to family members, providing step-by-step instructions for disabling protections and installing malicious software.
Google notes that these attacks exploit fear to override native Android alerts. Forced waiting and temporary blocking of communications prevent the fraudster from maintaining continued influence, giving the user time to regain composure and verify information.
Implementation and scope
The new policy comes into effect in the second half of 2026, with an initial rollout via an update to the Google Play services. Ela affects sideloading of unverified apps while maintaining compatibility with apps from trusted sources. Advanced Usuários preserve access to personalized features, while overall protection increases against evolving threats.
The measure reinforces layers of defense without eliminating features for enthusiasts. Google plans ongoing updates based on fraud patterns observed globally.
Updates for developers
Developers will face expanded authentication requirements before publishing apps distributed outside of the main stores. Contas limits allow restricted sharing without extra fees. Essas options aim to balance innovation and user protection.
The announcement integrates broader efforts by Google to raise security standards in the Android ecosystem. The company emphasizes proactive prevention in regions with a high incidence of phone scams.