RCS as Security Infrastructure: What the Google Fake Call Detection Launch Means for Your RCS Strategy
Google just put RCS at the center of Android's defense against AI voice scams.
The June 2026 launch of fake call detection in Google Phone uses E2EE RCS as a "digital handshake" — a real-time cryptographic verification that a call is actually coming from the contact's device, not an AI-cloned impersonator. This isn't a feature update. It's a category shift. The protocol your business depends on is no longer just rich messaging. It's carrier-grade authentication infrastructure.
That changes what "RCS readiness" means for every business integrating RCS — and it expands the scope of what you need to test.
What Google Actually Built
The fake call detection feature works on a simple premise: when a call comes in, Google Phone checks whether the calling device can complete a cryptographic handshake over E2EE RCS. If the handshake succeeds, the call is verified as coming from the actual contact's device. If it fails — or if the handshake can't even initiate — the system flags the call as a potential scam.
The technical requirements are specific:
- Both parties need Android with Google Phone and Google Messages installed and updated
- E2EE RCS must be active on both devices — not just RCS, but the encrypted variant
- The handshake is silent and real-time — it happens in the background during the call setup, with no user-facing action required
- Missing or failed handshake triggers a verification ping — the user sees a warning that the call may not be from the claimed contact
This is a fundamentally different use of RCS than anything we've seen before. The protocol is now doing authentication, not just message transport. A successful handshake proves device possession, not just network reachability.
The E2EE RCS Landscape: iOS 26.5 Changes the Map
Encrypted RCS between Android and iPhone launched with iOS 26.5 in May 2026 — about a month before the fake call detection rollout. This is the first time cross-platform encrypted RCS has been production-ready at scale.
What "supported carriers" means in this context:
- US carriers: All three majors (Verizon, AT&T, T-Mobile) support cross-platform E2EE RCS as of June 2026
- EU carriers: Vodafone, Deutsche Telekom, Orange, and Telefonica have rolled out or are rolling out
- APAC: Mixed support — Japan (docomo, SoftBank) and Australia (Telstra) are live; others are in deployment
The practical implication: the encryption surface your business depends on is no longer Android-only. If you're building A2P RCS flows, your messages may be E2EE-encrypted in transit to iOS users. That adds compliance requirements most teams haven't planned for — key management, metadata exposure, and audit trail obligations vary by jurisdiction.
The Testing Scope Expansion
Before June 2026, the standard RCS test suite covered:
- Message rendering (text, rich cards, carousels)
- Suggested actions and replies
- Read receipts and typing indicators
- Fallback to SMS or MMS
- Group chat behavior
- File transfer (images, video, documents)
After June 2026, the minimum bar expands to include:
- Cryptographic verification flows — does your RCS stack complete the E2EE handshake reliably?
- E2EE key exchange — are keys rotating correctly across sessions?
- Device attestation — can you verify the connecting device is the claimed device?
- Fallback security paths — what happens to security guarantees when RCS falls back to SMS?
Here's the blind spot in most existing RCS test suites: testing "message arrived" is not the same as testing "security handshake succeeded." A message can render perfectly, complete with a verified sender badge, and still fail the cryptographic verification layer that fake call detection depends on.
The new minimum bar: validate your RCS stack as a security-critical system, not just a messaging system. If RCS is doing authentication, your test coverage needs to include authentication failure modes.
The Fallback Security Gap
Google's fake call detection requires the full Android stack — Google Phone, Google Messages, and E2EE RCS all active. The moment one of those pieces is missing, the security guarantee breaks.
This creates a fallback security gap most businesses haven't mapped:
- RCS → SMS fallback isn't just a UX downgrade anymore. It's a security downgrade. An SMS-routed message doesn't have the cryptographic verification layer that RCS provides. If your business uses RCS for customer verification or authentication, the fallback path needs explicit validation.
- The multi-channel identity problem. When a user switches from RCS-verified Android to SMS fallback (because they're on a device without E2EE support, or in a region without carrier coverage), does your system know? Most RCS implementations treat fallback as transparent — the message gets through, the user sees it, and the system marks it as delivered. There's no flag for "this delivery used a less-secure path."
- Cross-platform fallback. An iOS user receiving an RCS message from an Android sender has a different security profile than two Android users. The encryption is E2EE, but the device attestation layer varies by platform.
For businesses using RCS for customer verification, two-factor authentication, or any flow where message authenticity matters, the fallback path is now a security-critical surface that needs to be tested and documented.
What This Means for Your RCS Roadmap
Security-critical RCS is now a product category, not just a messaging feature. The businesses shipping RCS integrations need to think about three things they didn't need to think about before:
Validation depth. "It works in staging" isn't enough when the protocol is doing authentication. You need carrier-grade validation that tests both messaging and security flows against real carrier behavior, not just emulator simulations.
Fallback security mapping. Every RCS flow in your product needs a documented fallback security profile. What happens when RCS → SMS? What happens when E2EE isn't available? What happens when the device attestation layer is missing? These aren't edge cases anymore — they're primary failure modes.
Cross-platform test coverage. With iOS 26.5 enabling cross-platform E2EE RCS, your test matrix has expanded. The Android-only test suite that worked in 2025 is no longer sufficient. You need coverage that includes iOS as a first-class participant in the security model.
RCS X is built for exactly this moment: validating your entire RCS implementation — messaging and security flows — across carriers, devices, and fallback paths before production. The pre-launch validation layer for a protocol that's now doing authentication.
Actionable Steps for RCS Teams
If you're shipping RCS integrations in 2026, here's what to do this week:
- Audit your current RCS test coverage. Are you testing security flows, not just rendering? If your test suite doesn't include cryptographic verification tests, you're not ready for the June 2026+ landscape.
- Map your fallback chains. What happens when RCS → SMS? Document the security equivalence — or explicitly flag the gap. Don't treat fallback as transparent.
- Validate E2EE compliance. Are your RCS messages meeting the cryptographic standards now required? Key rotation, attestation, and metadata exposure all need to be in scope.
- Test across the Android-iOS divide. Cross-platform is real, and your fallback logic needs to be production-ready. The test matrix is no longer Android-only.
- Build carrier-grade validation into your CI/CD. Don't ship RCS features without testing against real carrier behavior. Staging validation isn't enough when the protocol is doing authentication.
The protocol evolved. Has your testing?
Try RCS X free — validate your RCS implementation across carriers, devices, and security flows before production. No carrier agreements needed.