Is Google Play Protect Enough? What Android's Built-In Scanner Catches and Misses
Key Takeaways
Your Android phone comes with a security scanner already running in the background. Google Play Protect checks apps automatically, requires no setup, and costs nothing. For most people, it's the only layer of protection they ever think about, which is exactly why it's worth understanding what it can and can't do.
The short answer is: Play Protect is a solid baseline, but it has real gaps. Here's where it holds up and where it quietly falls short.
What Google Play Protect actually does
Play Protect is part of Google Play services and runs on certified Android devices. According to Google, it scans over 350 billion apps every day, including apps from sources outside Google Play. Google's Play Protect help page describes how it works.
It works in a few key ways:
- App checks at install time: Apps from Google Play get a safety check, and Play Protect also checks apps you install from other sources.
- On-device and cloud analysis: Play Protect uses on-device machine learning and similarity checks, and can send apps it hasn't seen before to the cloud for deeper analysis (Google).
- Background scans: It periodically re-checks installed apps, even ones you haven't opened in a while.
- Real-time scanning of sideloaded apps: For apps installed from outside Google Play, it can run a real-time check against known harmful samples.
Other Google protections sit alongside it but are separate services, including Safe Browsing in Chrome and Find Hub (formerly Find My Device) for locating or wiping a lost phone.
That's a meaningful set of protections for a free, zero-setup tool. The question is whether it's enough on its own.
Where Play Protect performs well
Independent testing tells a better story than you might expect. In May 2024, AV-TEST, an independent security testing lab, gave Google Play Protect a perfect score of 18 out of 18 across more than 5,700 samples combined. AV-TEST Its most recent result, in September 2026, was 17.5 out of 18, with 99.6% of real-time threats and 99.8% of widespread malware detected. AV-TEST
That's a significant improvement from where Play Protect started. AV-TEST gave it a protection score of 0 out of 6 from its first test in 2017 through 2021. AV-TEST Since March 2024, its protection scores have stayed between 5.5 and 6 out of 6.
For the average person installing apps from the Play Store and browsing on Chrome, Play Protect provides a reasonable level of protection against the most common threats.
What Play Protect misses
Here's where things get more complicated. Lab scores measure known, documented malware. Real-world attackers don't play by those rules.
Repackaged and re-signed apps
Researcher Ahmad Abolhadid at ERNW tested Play Protect against Anubis, a well-documented Android banking trojan. When installed in its original form, Play Protect blocked it. But when the same malware was re-signed with a new signing key, it installed without a warning, and Play Protect scans afterward didn't flag it. Insinuator.net
This matters because re-signing is a basic technique. It doesn't require sophisticated skills. The malware's core behavior stays identical; only its digital fingerprint changes. The author suspects Play Protect relies on matching known samples, though testing from the outside can't confirm that. Google says Play Protect also uses on-device machine learning, cloud analysis, and behavior signals, and it has been adding more of these over time (Google).
Malware disguised as legitimate updates
In May 2024, Cyble Research discovered Antidot, a banking trojan that disguised itself as a Google Play update. It displayed a convincing fake update page in multiple languages, then requested Accessibility permissions to carry out overlay attacks, keylogging, screen recording, and remote device control. Cyble
The trick here is social engineering: the malicious behavior only starts after the user grants permissions, which is why a scan at install time can't tell the whole story. Google has added defenses against this kind of abuse, such as restricted settings for apps installed from outside an app store and, in Advanced Protection mode, limits on which apps can use Accessibility (Google). How much they help depends on your device, Android version, and settings.
Sideloaded apps and third-party sources
Play Protect does scan apps from outside the Play Store. But AV-Comparatives' 2024 Mobile Security Review found a bug in which cloud requests occasionally failed during testing, causing Play Protect to miss some malicious app installations. AV-Comparatives The 2025 review cited a cloud-request problem again. AV-Comparatives
The sideloading risk compounds over time. Once an app is installed and Play Protect doesn't flag it on the first pass, it can keep running until a later scan catches it, if one does. In ERNW's tests, one sample ran for hours before Play Protect detected it. Insinuator.net
Files, downloads, and non-app threats
This is one of Play Protect's clearest blind spots. Tom's Guide noted in its review that Play Protect scans apps, but doesn't look for malware in your system's files. Tom's Guide
Google's other protections help here: Chrome checks downloads through Safe Browsing, and Google Messages warns about some suspicious links. But a malicious file or phishing link that arrives through another app or browser may not be checked by any of them. Links and files like these are a common route for scams.
The gap between lab scores and real life
The 2024 AV-TEST score was real, and results have stayed strong since. But lab tests use known samples, while attackers build new ones, so a score doesn't tell you how Play Protect handles malware nobody has seen yet.
AV-Comparatives' mobile reviews are a useful second view. In its 2024 review, its testing helped Google narrow down a bug in Play Protect, and Play Protect was approved with a 99.3% score. AV-Comparatives In 2025 and 2026, Play Protect scored 98.8% and 98.9% and wasn't approved, falling just short of the 99% threshold. 2025, 2026
The takeaway isn't that Play Protect is broken. It's built to cover the common case: known malware, Play Store apps, and Chrome browsing, with newer protections for sideloaded apps and risky permissions. Anything outside that scope gets less coverage, and independent testing is how those gaps get found.
What you can do to cover the gaps
Play Protect should stay on. Turning it off removes the baseline. But if your phone is where you bank, shop, and manage your accounts, a single layer isn't enough.
A few things that help:
- Only install apps from the Play Store unless you have a specific, trusted reason to sideload. Third-party sources are where the riskiest apps live.
- Be skeptical of update prompts that appear outside the Play Store or Google's own update mechanism. Fake update pages are a common delivery vehicle for banking trojans.
- Review app permissions before granting them. An app that asks for Accessibility access, SMS reading, or launcher replacement rights deserves a hard look.
- Don't assume a clean scan means a clean phone. Play Protect can miss things, especially newly repackaged malware and threats that live in your files rather than your apps.
Keep Chrome's Safe Browsing turned on as well. If you want stricter protection, look at Android's Advanced Protection mode, which limits Accessibility to verified accessibility tools and blocks installs from unknown sources. Availability depends on your device and Android version.
Adding another layer of protection helps too, since many scams and phishing attempts now arrive through links in texts, emails, and social media rather than app downloads.
The bottom line
Google Play Protect is a useful, zero-effort layer of security that comes free with certified Android phones. It catches the most common malware, scans apps continuously, and checks sideloaded apps too. For someone who only installs popular apps and stays on well-known websites, it handles the basics.
But it scans apps, not the files on your phone. Researchers have shown it can miss re-signed malware. It can struggle with a banking trojan that waits until you've granted it permissions. And phishing links and scam pages that arrive outside the protections of Chrome and Google Messages may not be checked at all.
Play Protect is a good start. It's not a complete answer.
Conclusion
Keep Play Protect on, install apps only from trusted sources, and be wary of update prompts and permission requests. Those habits cover gaps that a scanner can't.
Guardio doesn't replace Play Protect's app scanning, but it covers a related risk. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and Email Security flags phishing emails that get past the Gmail spam filter. Guardio also blocks malicious file downloads. No tool catches everything.
Get a free security scan with Guardio today and stay protected from phishing.
FAQs
Does Google Play Protect protect against all Android malware?
Google Play Protect catches the majority of known Android malware and scored a perfect 18/18 on AV-TEST in May 2024, and 17.5/18 in September 2026. It does not protect against all threats. Researchers have shown that re-signed malware can slip past it, banking trojans can wait until permissions are granted, and threats that arrive through files or links outside the protections of Chrome and Google Messages may not be checked.
Can Google Play Protect be bypassed?
Yes, researchers have shown that Google Play Protect can be bypassed in some cases. In ERNW's 2024 testing, re-signing a known banking trojan (Anubis) with a new certificate was enough to install it without a warning. The Antidot banking trojan, found in May 2024, disguised itself as a Google Play update and asked users to grant Accessibility permissions, a social-engineering step no scan can stop on its own. Google has added protections since, so results vary by device and Android version.
Does Google Play Protect scan downloaded files?
Not directly. Google Play Protect scans apps, including ones installed from outside the Play Store, but not the documents or other files stored on your device. Chrome on Android checks downloads through Safe Browsing, but a malicious PDF or a file that arrives through another app may not be checked. This is one of the gaps worth covering with a second layer.
Is Google Play Protect enough for Android security?
Google Play Protect is a solid baseline but not a complete security solution. It handles the most common threats well, especially apps from the Play Store. It has documented gaps around re-signed malware, sideloaded apps, file-based threats, and phishing links that arrive outside Chrome and Google Messages. Many Android users benefit from an additional layer of phishing and scam protection.
Should I turn off Google Play Protect?
No. Turning off Google Play Protect removes your baseline malware protection without adding anything in return. Even with its limitations, Play Protect catches a large volume of known threats automatically. The better approach is to keep it enabled and add another layer of protection to cover the gaps it doesn't address.
What does Google Play Protect not protect against?
Google Play Protect scans apps, so it isn't built to check documents or other files. Researchers have shown that re-signed malware can slip past it, and malware that only activates after you grant it permissions can be hard to catch at install time. Phishing links and scam pages that arrive outside the protections of Chrome and Google Messages may not be checked by anything.
