Android protection: Play Protect, permissions, and antivirus.
Put Rodrigo Pereira
On Android phones with Google services, Play Protect offers built-in protection against potentially harmful apps. It works through the Play Store and can scan apps during installation and periodically. Before choosing another tool, it's worth checking this protection and the special access granted on the device.
Play Protect can also scan apps installed from outside the app store. This doesn't make any APK trustworthy: modified versions, fake banking updates, and tampered games can pose risks. The origin of the installer, system updates, and attention to login requests remain part of the protection.
This guide shows you how to check if this protection is active, how to review four special access permissions, and what an in-store antivirus adds on top of that.
The antivirus that came pre-installed on your phone.
Play Protect does three things, according to Google's help center: it checks apps when you install them, performs periodic checks on your device, and if it finds a potentially harmful app, it warns you, disables, or removes it. On devices with Android 6 to 10, it also resets permissions for apps you haven't opened in three months; from Android 11 onwards, this is handled by the system itself. It even covers apps from outside the app store: when installing an APK, you can request to send the file to Google for analysis via the "Improve detection of harmful apps" option.
The coverage of a security tool depends on the product and the permissions available. Some applications complement app analysis with address filters, verification of accessible files, or leak monitoring. None of them identify all scams or replace recipient verification before sharing data.
How to check if Play Protect is turned on
It takes a minute and requires no installation. The path is as described in... Play Protect official page, On devices with the Play Store, names may vary by version.
- Open the Play Store and tap your profile icon in the upper right corner.
- Tap Play Protect. The screen shows the last scan and the Verify button, which runs a manual check on the spot.
- Tap the gear icon at the top. Turn on “Verify apps with Play Protect” and “Improve detection of harmful apps”.
If the option was disabled, turn it on and run a scan. This, in itself, does not prove infection. Also check the recommendations provided by Google itself, without disabling protection to comply with requests from an unknown application.
How does malware enter Android?
The Play Store has verification and removal mechanisms, but it doesn't eliminate all risk. Outside of it, check who distributed the installer and if there's an official source. A familiar icon doesn't prove the package is genuine. Installation requests received via message, especially for updating your bank account or unlocking rewards, should be verified directly with the service involved.
Google also applies enhanced protections against certain apps from external sources that request sensitive access. Criteria and warnings vary by device and feature availability. If an installation is blocked, consult the displayed guidance and the developer's official distribution, rather than trying to circumvent the block.
Messenger mods require caution regarding the origin of the package and account data. The guide on WhatsApp GB and alternatives to its functions. It explains the differences compared to the official app.
Four special access points for reviewing
Malicious applications can abuse permissions or exploit vulnerabilities. Special access, by itself, does not identify malware: screen readers, management tools, and other legitimate services also need them. Check if the function matches the application and if you know who is responsible for it.
1. Accessibility
Accessibility services can observe interface elements and perform actions according to the system's configuration and restrictions. They are essential for assistive technologies and are also used by some security tools. Authorize only after understanding the purpose, origin, and scope of the request.
Where to review: Settings, then Accessibility, under Downloaded Apps or Installed Apps. Identify each service before disabling it; preserve the assistive features you rely on. If there is an unknown app, check its profile and installation information.
2. Access to all files
Android limits access to storage. Granting access to all files expands reading and managing shared files, but doesn't automatically release private data for all applications. File managers may need it; check why other types of apps request it.
Where to review: Settings, Apps, Special app access, “Access to all files”.
3. Display over other apps
It's screen overlay: the app draws a window on top of whatever is open. Legitimate use is the Messenger bubble. Criminal use is the fake login screen drawn over the bank's app, pixel-perfectly, to capture the password.
Where to check: Settings, Apps, Special app access, “Show over other apps” (on some devices, “Overlay other apps”).
4. Device Administrator
Administrator access enables certain security policies and may require disabling before uninstallation. Capabilities vary depending on the Android version and management type. On work or school devices, consult the administrator before removing necessary settings.
Where to review: Settings, Security, or Security & Privacy, looking for Device Admin Apps. Examine the name and policies. If you decide to remove a personal app, disable its access and then uninstall it; on managed devices, follow your organization's guidance.
“Install unknown apps”: the switch that gets forgotten
Since Android 8, permission to install APKs is granted per app, not for the entire system. You allow Chrome once and the authorization may remain active; the same with WhatsApp and the file manager. Malware takes advantage of this. Go to the list in Settings, Apps, Special app access, “Install unknown apps”:
- Browser (Chrome, Samsung Internet, Firefox): Off. If you ever need to install something from outside, turn it on, install it, then turn it off.
- Messaging apps (WhatsApp, Telegram, Messenger): always off. Messages can distribute pirated installers.
- File manager and download app: turned off.
- Manufacturer stores and services: check which ones they use, their origin, and the necessary access points, without assuming that a well-known name guarantees provenance.
- App that you don't recognize with this permission enabled: turn it off and skip to the infection signs section.
What does an antivirus from the store add to Play Protect?
An additional tool can be useful when it meets a specific need. Read the Android version's information sheet and check which features require a subscription, special access, or an internet connection.
File verification. Some products scan accessible files and installers. The scope depends on the system and permissions; don't assume that all antivirus software can read any folder, document, or private content of another app.
Link protection. Filters can alert you to addresses identified as malicious. Coverage varies by browser, application, configuration, and plan. A new address may slip through the analysis, and a warning should not be ignored just because the message came from a contact.
Leak alert. The monitoring system searches for information in known databases. When an alert is received, check the affected service, change any reused passwords, and enable two-factor authentication. The absence of alerts does not prove that your data has never been exposed.
In addition to that, there's the Wi-Fi checker, which indicates whether the café's network is unencrypted, and the VPN, which in free plans usually comes with a small daily data allowance.
Free vs. paid: what changes with the subscription?
Free installation, trial period, and permanent free use are different conditions. Bitdefender Mobile Security is a distinct product from the same company's Free Antivirus. Check the exact name, the features included, and the renewal process before subscribing. Don't choose solely based on the number of advertised features.
The antivirus programs I checked on the Play Store
The four below were active on the Brazilian Play Store when I wrote this, all free to install. Ratings and downloads are what the store showed and may have changed slightly by the time you open it.
Avast One
Avast One combines threat scanning and privacy features. Check the product page to see which features are available in the free plan and which require a subscription. Package names and the combination of web protection, alerts, and VPN may vary; compare the offer shown in your account.
Avast One Antivirus, Security
AndroidBitdefender Mobile Security
Bitdefender Mobile Security offers threat protection and additional features for links and privacy. The fact sheet explains the necessary access and the trial period. Check what will remain active after this period and don't confuse the product with Antivirus Free, which has a different purpose.
Bitdefender Mobile Security
AndroidNorton 360
Norton 360 combines security and privacy features under subscription terms. Check which messaging, network, VPN, and monitoring functions are included in the offer available in Brazil. Installing the app does not automatically activate all features, and a trial may be linked to plan renewal.
Norton 360: VPN and Antivirus
AndroidMalwarebytes
Malwarebytes offers threat analysis and features focused on fraud attempts. The availability of continuous protection, filters, and VPN depends on the plan. For further analysis, check the features that can be used on demand and avoid maintaining unnecessary duplicate services.
Malwarebytes Mobile Security
AndroidAnd what about Kaspersky? It's been removed from the Brazilian Play Store: searching for the package returns a non-existent page. The company remains on the App Store with Security & VPN by Kaspersky, but for Android, the advice is not to download the APK from the website to work around the absence. iPhone users will find the iOS scenario, which is different, on the App Store. iPhone protection guide against malware.
Extra layers: app lock and lost phone.
Additional app locks can be helpful when someone else is using your unlocked phone. First, check the options offered by Android itself, the manufacturer, and the app: there are biometric locks for messaging apps and features like Secure Folder or private storage on compatible devices. It's not necessary to subscribe to an antivirus program for every privacy function.
Google's remote location and anti-theft protections available on Android are separate features from Play Protect. Check your device settings to see which ones are supported, ensure the account is correct, and understand the conditions under which you can locate, lock, or erase your device. Remote erase is a data-removing measure; do not use it as a test.
Signs that something has already entered.
- Play Protect was turned off without you having touched it.
- Full-screen ad outside of any app, including the lock screen.
- Icon that disappears from the drawer shortly after installation.
- An app with accessibility or administrator permissions that you don't recognize.
- Battery and mobile data draining overnight, with the phone idle.
- You received a confirmation SMS from your bank even though you did nothing.
These signs warrant investigation, but do not confirm malware. To assess the device, follow these steps. Step-by-step guide to removing viruses from your cell phone., which deals with the uninstallation process itself, including apps that refuse to uninstall.
If there are no symptoms, but you want to put an end to the matter once and for all, the routine of full mobile phone verification It shows the end-to-end scan and what to do with the report.
Common questions
Do I need internet access for the antivirus to work?
It depends on the product. Some scanners use cloud-based analysis and require an internet connection; Bitdefender Antivirus Free is an example. Other features may work partially with previously downloaded data. Updates, address lookups, and leak monitoring typically depend on the internet. Check the documentation for the installed tool.
Does using antivirus software slow down your phone?
Scanning can consume processing power and battery while it's in progress. The intensity depends on the device, the content being analyzed, and the tool. If there is a continuous impact, check battery usage and application settings. Avoid installing additional accelerators just to compensate for another service that is consuming resources.
Do two antivirus programs running simultaneously offer more protection?
There's no guarantee of benefit in maintaining two similar services in real time. They may repeat checks, consume resources, and compete for network configurations. Opt for a configuration that is easily understood; a second, one-off analysis only makes sense if you know which functions are active.
Is Play Protect enough on its own?
It's an important layer on compatible devices, but no configuration guarantees complete protection. Consider your usage, available updates, the origin of the applications, and the security of your accounts. An additional product should address an identified need, not just repeat functions you already use.
The first step takes a minute: open the Play Store, tap on your profile, go to Play Protect and check if scanning is turned on. Then go through the four permission screens. The antivirus comes last, and now you know what you're buying.
