New Android 15 Security Leak—Will Google Add iPhone-Like Protection?

Smartphones today increasingly lack truly unique innovations, as Android devices and iPhones frequently borrow features from each other. This is evident in device security, demonstrated by the leaked upcoming Identity Check feature in Android 15, which closely resembles the Stolen Device Protection functionality of iPhones.

What Is Android’s New Identity Check Feature?

Let’s start with what it isn’t, shall we? It is neither here yet nor confirmed as coming with Android 15, although I have reached out to Google for a statement and will update this article should one be forthcoming. However, according to the respected publication Android Authority, known for delving into the depths of Android Beta release code, there’s evidence that it’s coming soon.

It seems, however, that the new Identity Check feature will force the use of biometrics to unlock your device, and apps, rather than allowing a lock screen PIN or password, when the smartphone is outside of a previously mandated trusted geographic location. If that sounds familiar then you probably are, or know, an iPhone user. As Apple describes it, using Stolen Device Protection “some actions, such as accessing stored passwords and credit cards, require a single biometric authentication with Face ID or Touch ID – with no passcode alternative or fallback option – so that only you can access these features.” Importantly, this additional layer of iPhone security is only invoked when the smartphone is away from specific locations such as your home or workplace.

Digging Through Android 15 QPR1 Beta 2 Code Reveals Security Secrets

We can thank Android Authority’s Mishaal Rahman for digging through the latest Android 15 QPR1 Beta 2 release code and finding an intriguing string that had newly appeared in the code for the settings. The string of code included “Identity Check is on” when summoning the biometric prompt in the new Android OS. Things get really interesting, as Rahman discovered, when you realize the same feature is referenced many times in relation to the biometrics functionality of Android in relation to the triggering of mandatory biometrics. Although it’s unclear at this point precisely what will pull that trigger, it’s clearer when it won’t be pulled: “when apps invoke the biometric prompt dialog with a PIN/password/pattern fallback.”

So, the new Identity Check feature appears to address a major security problem that currently plagues Android owners: someone who has stolen their smartphone and knows the unlock PIN (easily noted by shoulder surfing in crowded places, for example) can gain access without having the right face or fingerprint. How do we know this? Well, that same Beta code reveals a flag that states the PIN fallback should be removed when the phone is outside trusted locations. Specifically, Android will remove the Lock Screen Knowledge Factor from the biometric prompt dialog. This, it would appear, will be an additional layer of security to the Trusted Places feature in Android, the thing that enables you to keep your smartphone unlocked while at home or at your desk.

I’ll be sure to keep you updated with any additional news of this forthcoming feature as I get it, including if it will be included in the initial Android 15 update.