Google plans stricter app verification on Android but will keep a sideloading path for power users

Google’s upcoming verification rules for Android app installs are moving ahead, but the company is building an alternative route for technical users who want full control over sideloading. The approach balances stronger protection for the general public with a manual bypass for those who genuinely understand the risks.

Google first announced its developer verification requirement in August, stating that all Android apps, including those installed manually, would eventually need to come from a verified developer account. Early access to that system begins today. The company is pushing this change as a defence against increasingly aggressive social engineering schemes, particularly in regions where scammers pressure victims into installing fake “security apps.” Google says technical safeguards alone cannot prevent these attacks because scammers often manipulate users into overriding warnings.

To address the needs of developers and enthusiasts who rely on sideloading for legitimate reasons, Google is building an “advanced flow” intended for what it calls “experienced users.” This opt-in path will let users accept the risks of installing unverified software. Google stresses that the flow is designed to resist coercion. It wants to ensure that scammers cannot easily force victims to bypass verification by following scripted instructions. The process will include strong, unskippable warnings and extra friction to guarantee that anyone using it genuinely understands the danger. Google is currently testing design concepts and plans to reveal more details in the coming months.

The company has also outlined why it considers verification essential. A recurring scam pattern in Southeast Asia demonstrates how attackers exploit sideloading. Fraudsters call victims, claim their bank account is compromised, and instruct them to install a “verification app” by ignoring system warnings. Once installed, that malicious app monitors notifications and steals two-factor authentication codes as soon as the victim logs into their real banking app. According to Google, even with aggressive detection systems, unverified distribution makes it too easy for attackers to replace malware daily, creating an endless “whack-a-mole” cycle. Forcing developers to use a real, accountable identity raises the cost of these operations and makes impersonation far more difficult.