Google Play Services permissions

Corsair

Some banking apps require Google Play Services to access SMS and Phone.

Does the banking app has access to Phone call and SMS history?

I use Shelter to create a Work profile and have Google Play Services there. Giving access to Phone and SMS will give Google Play Services access to my Main profile call/SMS history?

unwat

Corsair Does the banking app has access to Phone call and SMS history?

Not in this case. If you grant these permissions to Google Play Services, then only Google Play Services will have access to that data. In my experience, Google Play Services only needs that access to auto-fill one time passwords sent via text.

Corsair I use Shelter to create a Work profile and have Google Play Services there. Giving access to Phone and SMS will give Google Play Services access to my Main profile call/SMS history?

I don't use shelter, so I don't know from personal experience, but I'd say it's likely.

Corsair

unwat

I was using Wise (formerly TransferWise) to wire some money. The process was stuck* until I gave Google Play Services permissions (phone and SMS).

A pop-up appeared asking for those permissions.

So my question is what's happening behind the scenes. Is Google Play Services just sending a confirmation like "we have access and it's all good" or "this is the data".

unwat

Corsair

I can't know for sure since the app is closed-source, but my guess is that they've implemented something like this: https://developers.google.com/identity/sms-retriever/overview.

Based on this article, the app might ask for the phone number to verify that phone number has already been associated with your account. If not, the app should have logic for verifying and adding a new phone number to the account, usually including a SMS one time password. Google Play Services will listen for incoming text messages and if it finds the one sent from the app it'll send the whole text message string to the app.

According to Google Play Services' permissions on my phone, the permissions include:

Phone

read phone status and identity (whether you're in a call and phone number, maybe other stuff I'm not aware of)
directly call phone numbers

SMS

receive text messages (SMS & MMS)
send and view SMS messages
read your text messages (SMS & MMS)

maximus87

I am also not sure why some Apps do this. My banking App had the exact same warning. Luckily it still works despite it.
I think the idea is to use the APIs to directly access the SMS content for verification purposes when registering. But honestly, I also didn´t grant the permissions. As I am not sure if Google Services will start scanning (and somehow sending home) all my received SMS and call history :/