Android 17 QPR2 Beta 3 adds a small but meaningful barrier against a familiar fraud pattern: persuading someone, or an app, to activate call forwarding without a clear final check. The new protection targets programmatic use of call-forwarding USSD codes, rather than call forwarding itself. That distinction matters.
Google released Beta 3 on August 14 for the Android 17 QPR2 track. It is a preview release for supported Pixel devices, not a general Android update, so it should not be installed solely for this feature. But the change shows where Android is moving: sensitive phone actions should be visible to the person holding the phone, not silently delegated to an app in the background.
What Google changed
In Beta 3, Android parses and selectively restricts call-forwarding codes sent through the TelephonyManager.sendUssdRequest() API. An ordinary app with only the CALL_PHONE permission can no longer use that API to run a call-forwarding code in the background. Instead, the request is blocked and the app receives the USSD_ERROR_NOT_ALLOWED callback.
The other half is aimed at social engineering. When a person manually enters a call-forwarding code in the system dialer, Android now presents an operating-system confirmation before the command runs. This does not remove call forwarding, which can be legitimate for work numbers, travel, or accessibility workflows. It makes the irreversible-looking moment harder to hide behind a hurried instruction from a caller, a message, or a malicious app.
What changes in practice
For most people, nothing needs to be enabled and there is no new security toggle to hunt for in Settings. The safeguard applies when a device is running this QPR2 Beta 3 build and an app tries to use the affected API path. Standard account checks and other non-call-forwarding USSD requests are not affected, according to Google.
The practical limit is just as important: this is not a universal anti-scam shield. It cannot make a user immune to a convincing caller, protect an account after its credentials have already been stolen, or override a carrier feature that is changed through a different route. Its value is narrower and more concrete: an app cannot quietly submit this particular type of forwarding command with only a broad phone-call permission, and a manual command gets a visible second look.
If you are already testing the Android 17 QPR2 preview on a supported Pixel, check the build number in Settings > About phone > Android version. Beta 3 is listed by Google as CP41.260731.005.A2 or CP41.260731.005.B1. People on the stable channel should wait for the normal release path rather than enrolling a daily phone in a beta just for one security improvement.
What app makers need to check
The important compatibility work is for apps that genuinely set up call forwarding. They need to handle USSD_ERROR_NOT_ALLOWED instead of assuming a background request will complete. Google recommends moving eligible flows to ACTION_DIAL, which can pre-fill the system dialer while leaving the final action and confirmation to the user.
That is a useful line to draw. A convenience feature is not a reason to hide a change that can redirect calls and disrupt account recovery. The same principle is behind other Android permission hardening: the least surprising route is usually the one that keeps the action in the system UI when the consequence is serious.
For broader context on the preview track, see our Android 17 QPR2 Beta 1 eligibility and exit guide. Beta releases can fix real issues while also introducing new ones, so a test device remains the sane place for them.
In brief
- Android 17 QPR2 Beta 3 restricts programmatic call-forwarding USSD requests made with only
CALL_PHONE. - Blocked apps receive
USSD_ERROR_NOT_ALLOWED; legitimate flows should use the system dialer and a user confirmation. - Manual call-forwarding commands now show an OS-level confirmation dialog.
- The feature is part of the Pixel QPR2 preview and is not a reason to install beta software on a primary phone.
Sources
- Android Developers — Android 17 QPR2 release notes (primary source; Beta 3 released August 14, 2026; checked August 17, 2026)
- Android Authority — Android 17 QPR2 Beta 3 takes cell network security to the next level (published August 17, 2026)