Play Protect & SMS restrictions

Both problems on this page are avoided entirely by installing from Google Play . Read on if you are sideloading a build of your own.

Installing Luno from a browser, messaging app or file manager can surface:

This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud.

This is not a defect in the app and not a malware detection.

The warning

It is Google Play Protect’s enhanced fraud protection, a policy heuristic that fires on the combination of two things:

The app declares one of four sensitive permissions — RECEIVE_SMS, READ_SMS, NOTIFICATION_LISTENER, ACCESSIBILITY; and
the install came from an “internet-sideloading source” — a browser, messaging app or file manager.

Luno declares RECEIVE_SMS for inbound capture, which is enough to trip it. Google’s stated rationale is that over 95% of installs of major fraud-malware families came from internet-sideloading sources. The heuristic is deliberately crude, so a legitimate gateway trips it too.

Worth being precise about what does not trigger it:

SEND_SMS is not on the list, so it never causes the install-time warning. This is not the same as saying outbound-only builds are unaffected — see restricted settings below.
Luno does not declare READ_SMS, does not request the default-SMS-handler role, and uses no accessibility or notification-listener APIs.

Restricted settings: a separate, and harder, block

Play Protect’s warning is about installing. Android’s restricted settings is a distinct mechanism about granting, and it is the one that stops the gateway from working at all.

From Android 15, SEND_SMS and RECEIVE_SMS are hard-restricted permissions for any app not installed from an app store. The toggle is greyed out and the runtime request is auto-denied with no dialog — the user just sees “App was denied access to SMS”. Nothing in the APK influences this. It is decided by the install source, so no manifest flag, targetSdk or code path can opt out.

The consequence for the flavor split is blunt: sendOnly installs clean but still cannot send when sideloaded. Dropping RECEIVE_SMS avoids the install warning and nothing more.

Recovering on-device

On the device

Settings → Apps → Luno → ⋮ → Allow restricted settings, then Permissions → SMS → Allow.

The app detects this state rather than looping silently: native reports PermissionStatus.BLOCKED and the tile explains that Android refused the last prompt. See Permissions for why that status is treated as a hint rather than a verdict.

Install paths that avoid the warning entirely

Enhanced fraud protection only applies to internet-sideloading. These paths are exempt, and let you run the full flavor with no warning:

adb install — the normal path for a self-hosted operator installing on a device they control.
Managed Google Play / EMM agent (DPC) — apps installed through an enterprise agent, including private apps uploaded to managed Google Play, are not subject to it. This is the most reliable route for fleet deployments.
Google Play Store — public Play installs are exempt.

Play Store installs are exempt from both mechanisms, which is why Play distribution is the supported path for anything beyond local development.

Play Store distribution

Luno is published on Google Play, which is the durable fix and the supported route for anything beyond local development.

If you are distributing your own fork, note that SMS permissions require a Permissions Declaration Form in Play Console and a policy review. Apps that are not the default SMS handler need an approved exception use case. Two of Google’s listed exceptions cover Luno:

Device automation — “automation of repetitive actions across OS areas based on user-set conditions.”
Enterprise / CRM — enterprise messaging systems.

Explicitly invalid use cases include account verification via SMS, content sharing and invites, and social profiling. As of the July 15 2026 policy update, account verification by phone call is no longer accepted for READ_CALL_LOG either; the Digital Credentials API and SMS Retriever API are the sanctioned alternatives.

None of the invalid cases describe Luno, but a self-hosted gateway is an unusual shape for review, so budget for iteration on a fork. If a build is flagged and you believe it complies with the Unwanted Software Policy, Play Protect classifications can be appealed.