Bank apps mandating SMS OTP autofill - workarounds?

4x0

did you update?

updated, tested and failed 🫡

Novalissoide

4x0 one last thing to try.

In app info for both your banking app, as well as for Sandboxed Google Play Services, there is these Verified links checkboxes (in 'open by default' > add link). I've had a couple of apps that started working only after enabling some of these.

4x0

Novalissoide

In app info for both your banking app, as well as for Sandboxed Google Play Services, there is these Verified links checkboxes (in 'open by default' > add link). I've had a couple of apps that started working only after enabling some of these.

That would be crazy if it worked - I will try tomorrow

4x0

Novalissoide

In app info for both your banking app, as well as for Sandboxed Google Play Services, there is these Verified links checkboxes (in 'open by default' > add link). I've had a couple of apps that started working only after enabling some of these.

sadly this also failed - I seem to have exhausted all options (including using gboard & google messages)
if anybody has can confirm or has any information on a Google Play Services autifll from SMS working on any app on GOS - please call me

Novalissoide

4x0 Yes, I'm also scraping the bottom of the barrel now.

For what it may be worth;
This is just some lines from an old unfinished compilation from this support forum of things that might be scary for bank apps.

Location not enabled, or fake location detected
Having a private space
App installed in secondary user
More than one profile running
Not having Play Services installed
App not installed from Play Store
Using a less common keyboard app
Developer options enabled
Adb used
Having no sim
System time out of sync
Screen sharing detected
Very short system uptime
Vpn detected
Proxy usage
Private DNS enabled

Novalissoide

4x0 the 2026011000 release is up as alpha now.

aurocha

I'm having this issue with a banking app that used to work fine not too long ago. I do receive the SMS but it's not automatically auto filled and the app doesn't allow me to enter the code manually. Obviously SMS and Phone permissions are active. I noticed this recently because I had to reinstall and I was losing my mind until I found this thread.

Was some change introduced that borked SMS autofill?

I found out that using the same app in a Private Space with Google Play Services works, the SMS is received and auto filled, thus completing the activation.

But Private Space doesn't have access to NFC, which is a bummer. I can always make payments via QR Code.

I'll be following this thread to see if anything changes and works for you guys.

Cheers,

Novalissoide

aurocha first steps ceteris paribus is to look at the following two places:

https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos

Look for the specific bank and its app if it is listed here, if it is then you have at least one report of the app working or not working, typically with steps the reporting user took to either get the app working, or the steps they tried but failed.

Then go to
https://discuss.grapheneos.org/d/8330-app-compatibility-with-grapheneos

these recommended steps to try, go through them and keep eyes open for changing behaviour from the app.

And be specific when reporting to us here, what did you try? Which specific application are we talking about?

aurocha

The app is known to work and I've used it successfully until a while back. It's Portugal's MB Way app. The only permissions GPS used to require were Phone and SMS, and obviously I tried them, to no avail, the SMS OTP code isn't being auto filled as it used to.

I think this has been fixed in here:
https://github.com/PrivSec-dev/banking-apps-compat-report/issues/846

I just have to wait for the release and report.

Cheers,

aurocha

Novalissoide

aurocha that is great news. If this plays out like expected, so many users will benefit from this. ☺️

aurocha

Hello,

I was so eager to receive the latest update that I couldn't even wait for it to become available in the updater.

So I went ahead, downloaded the ota update, flashed it via adb sideload and installed the above mentioned MB Way app.

Didn't work. The SMS code isn't being auto filled in the app.

Cheers,

mmobder

4x0 the latest GOS update mentions "fix an issue in our infrastructure for spoofing permission self-checks breaking automatically reading SMS one-time codes for certain apps", should arrive soon, dunno if relevant. FYI

aurocha

I'm on 2026011001. Issue still persists.

Novalissoide

aurocha Yeah so far none of the users I follow with this issue have reached a breakthrough since the update. 🫤

Novalissoide

aurocha could you try going
Settings > Apps > Special app access > Notification read, reply and control

Grant this to Sandboxed Google Play Services
Reboot, retry

muhomorr

Try allowing Play services access to read OTP SMS:
adb shell appops set com.google.android.gms READ_OTP_SMS allow

sheshoe

Novalissoide tried this, didn't work. problem persists

Baruum

I’m glad I came across this thread, as I’ve been experiencing the same issue. I first noticed it while using my banking app, which previously worked without any problems. With the newer OS versions, SMS OTP auto-completion no longer functions as expected.

Previously, granting SMS permissions to Google Play Services allowed OTPs to be automatically detected and filled in, but this behavior appears to have changed. The issue is not limited to banking apps; it affects any application that relied on Google’s SMS OTP auto-complete mechanism. For example, testing with apps like Bolt or WhatsApp shows that the OTP is no longer detected or auto-filled.

I can also confirm that following all the suggested troubleshooting steps above does not resolve the issue. Switching to the Alpha channel and installing the latest available updates does not fix the problem either. Additionally, the issue occurs across all user profiles on the device.

I’m happy to assist with testing or provide any additional information if it helps diagnose or resolve this issue.

beep-boop

I wonder what tech genius thought that it's really "more" secure to grab that sms :D

braum

Long time reader, just joined, Although i have been very pleased to use grapheneOS, i would really love to get my banking apps working, i tried digging through the logs, looking for things.
Stuff like
AutofillManager: onInvisibleForAutofill(): expiringResponse were there as mentioned in this github issue

also a lot of these SElinux
avc: denied { read } for comm="Thread-45" name="enforce" dev="selinuxfs" ino=4 scontext=u:r:untrusted_app

now i dont know if this is relevent, but i noticed these messages were a lot and only for
Play Services com.google.android.gms
Play Store com.android.vending
Bhim UPI app in.org.npci.upiapp

using other apps that access play services didnt produce any of these messages.
I have been trying mixing various things, like some permissions off, some on, mobile data on and off, same with wifi, even giving location permission, to both play services and the payments app, private space, different profile, nothing seems to work. Thought i'd share whatever i was able to find out.

« Previous Page Next Page »