Allow restricted settings on Android: what it guards, and when to say no
Why Android greys out SMS, accessibility and notification access for downloaded apps, why Play Protect blocks such apps in India, and when to allow them.
"Allow restricted settings" is an option in the three-dot menu on an app's App info page. It lifts Android's lock on accessibility, notification access and, from Android 15, SMS for an app you installed from a downloaded file rather than an app store. Those are the permissions fake bank and "KYC update" apps use to read your one-time passwords and watch your screen, so use the option only for an app you went looking for yourself, never because someone on a call or in a chat told you to.
We build Ledgerly, an expense tracker for India that asks for all three of these permissions, so we have read these rules from the app maker's side of the screen. That may sound odd from people who need these permissions, but we think Google is right to make this hard.
Why do scammers want these permissions?
The common version in India goes like this. A message arrives on WhatsApp or as a text: your bank account will be blocked today unless you update your KYC. Attached is a file named after your bank, or a link to one. You install it, it asks for SMS access, and from then on every one-time password your bank sends goes to someone else as well.
Microsoft's threat team described this pattern in 2023: fake apps shared over WhatsApp and Telegram, one dressed up as a bank's official KYC app, asking for permission to receive and send texts so it could read OTPs (Microsoft Security). In April 2026 the security firm CYFIRMA took apart a newer one, also spread over WhatsApp to Indian users, that forwards your texts in real time and asks for your ATM PIN and Aadhaar number on fake screens (CYFIRMA).
The Reserve Bank of India describes the same method in its own warning: unsolicited messages, a link to an unverified app, and a threat that your account will be frozen if you do not act (RBI, February 2024).
The Microsoft and CYFIRMA samples both run on SMS access. Google names two more permissions that fraudsters abuse, notification access and accessibility, which let them catch one-time passwords and spy on screen content (Google India). Here is what each one hands over.
SMS
Receive and read text messages
- What it hands over
- Every text as it arrives. The read permission also opens the inbox you already have.
- What a fraud app does
- Reads the one-time password the moment your bank sends it, and forwards it on. Fake KYC apps aimed at Indian bank customers are built around this.
- A fair reason to ask
- A budgeting app reading bank alerts. Google Play allows that under a named exception for SMS-based money management, and bans selling the data.
- Gates
- Play Protect fraud block. Restricted settings from Android 15.
Notification access
Read other apps' notifications
- What it hands over
- The text of notifications from your other apps: chats, payment alerts, and codes that arrive as a notification.
- What a fraud app does
- Catches one-time passwords and messages from any app that shows them as a notification.
- A fair reason to ask
- An expense app reading UPI payment alerts that never arrive as a text. Ledgerly reads payment alerts from apps such as Google Pay, Paytm, PhonePe and BHIM, and ignores unrelated ones.
- Gates
- Play Protect fraud block. Restricted settings from Android 13.
Accessibility
See the screen and act for you
- What it hands over
- Whatever is on your screen, and the power to tap, type and move between apps on your behalf.
- What a fraud app does
- Reads what you see, banking screens included, and can take control of the phone. Google’s example of what gets stolen is banking information.
- A fair reason to ask
- Screen readers and other tools for people with disabilities. Ledgerly, as it ships on Google Play, reads order screens in a set list of shopping and food delivery apps and never taps, scrolls or types in them.
- Gates
- Play Protect fraud block. Restricted settings from Android 13. On Android 16, also refused while you are on a call.
Why did Play Protect say "App blocked to protect your device"?
This is the first of two gates, and it belongs to Play Protect. Google announced the fraud protection for India in October 2024 (Google India). If you install an app from a browser, a messaging app or a file manager, and that app declares any of the four permissions above (receive SMS, read SMS, notification access or accessibility), Play Protect blocks the install and tells you the app can request access to sensitive data (Play Protect developer guidance).
Google picked those sources for a reason: in the major fraud malware families it studied, over 95 percent of installs came from them. By February 2026 it said the protection covered 185 markets and had blocked 266 million risky install attempts in 2025 (Google).
This block never touches apps installed from Google Play.
Samsung phones can add a lock of their own. With Auto Blocker on, installs from sources Samsung does not authorise are stopped, while the Galaxy Store and Google Play still work. Galaxy phones released with One UI 6.1.1 have it on by default (Samsung India).
Why is the SMS or accessibility switch greyed out?
Because Android itself has locked it for that app. This is the second gate. Since Android 13, an app installed from a downloaded file can't get accessibility or notification access until you lift the restriction for that one app (Google Android Help, Android 13 source, accessibility, Android 13 source, notification access). Android 15 added the SMS permission, which is why the SMS switch can show up greyed out on a newer phone (Android 15 compatibility definition).
Android 15 also covers making the app your default SMS or phone app, device admin, usage access and drawing over other apps. In every case the rule depends on where the app came from: an app from an app store is not restricted, while one downloaded through a browser or messaging app, or installed from a file, is.
Installed from Google Play
- Install
Play Protect still scans the app. The fraud block does not apply: it is aimed at apps that arrive from browsers, messaging apps and file managers.
- The app asks for SMS, notifications or accessibility
Android shows its normal permission screen. You say yes or no to each one, and can change your mind later in Settings.
Installed from a link, a WhatsApp file or a browser download
- Gate 1: Play ProtectInstall
If the app declares SMS, notification access or accessibility, Play Protect blocks the install and says the app can request access to sensitive data.
Scammers often ask you to switch Play Protect off first. Android refuses that switch while you are on a call.
- Gate 2: Restricted settingThe app asks for the same permissions
If the app got installed anyway, its switch is greyed out. Tap it and Android tells you the setting is restricted for your security (for SMS on Android 15 and later, it says the app was denied access).
- Allow restricted settings
App info, the three-dot menu, then your PIN or fingerprint. One app at a time.
- Only now, the normal permission screen
The same yes or no the store path reached at step 2.
The second gate is older than the first. It arrived with Android 13 in August 2022 (Android Developers Blog), two years before the India block. Because it is part of Android itself, it still holds when a scammer has talked you into switching Play Protect off. Android's own source code spells out what it is for: before it, an app downloaded from a browser was a few taps from full control of the phone, and now you get a warning with no Allow button and have to find a different screen (Android source).
Google says phone scammers often try to talk people into changing security settings like that one. So in 2025 it added a rule for calls: during a phone call, Android won't let you turn Play Protect off, and on Android 16 it also won't let you install an app from a browser or chat for the first time, or give an app accessibility access (Google).
How do you know an app is safe to allow?
Real apps live outside Google Play too: open-source apps, tools your employer hands out, accessibility aids. Google's help page says some legitimate apps need this, and advises against it unless you trust the developer. Trust is hard to judge from a phone screen, so these are the four questions we would ask of any app, ours included.
An app you found on a developer's own site is a different thing from a file that arrived in a chat. RBI's advice for any KYC request is to check with your bank directly, on a number from its official website, and not to click suspicious or unverified links in messages.
If a caller, a shared screen or a deadline ("your account closes today") is pushing you, that pressure is the scam working. Hang up and call the bank yourself.
A budgeting app has a reason to read bank texts, and Google Play has a named exception for SMS-based money management (Google Play policy). It has no need to send texts, place calls or install other apps, and the malware CYFIRMA took apart asked for all three. A KYC form has no reason to ask for any of it.
A store listing, a website, a privacy policy that names each permission and says what happens to the data, a real way to reach a person. If the only proof the developer exists is the app file itself, stop.
Tap a box as you go. Checks reset when you leave this page.
If any answer is wrong, don't allow it. Uninstall the app.
How to allow restricted settings, if you're sure
Google's help page gives the short version: Settings, Apps, the app, then More and Allow restricted settings. It doesn't explain why the option is so often missing.
Android adds it to the menu only after it has shown you its restricted message for that app at least once, so start by tapping the greyed-out switch, then go back to the menu. We checked this in Android's source: the App info screen looks for that acknowledgement before it offers the option, and asks for your screen lock, if you have one, before it lifts anything (Android source).
Step 1. Try to switch the permission on
Settings, Accessibility or Notification access, or the app's SMS permission. The switch is greyed out. Tap it anyway.
Restricted settingFor your security, this setting is currently unavailable.On Android 15 and later, the SMS permission shows “App was denied access” instead, with a “Learn how to allow access” link. Tapping it still makes step 2 appear. Skip this step and the option will not be there: Android adds it only after it has shown you one of these messages for that app.
Step 2. Open the app's App info page
Settings, Apps, then the app. Tap See all apps if it is not listed. Then the three-dot (More) menu in the top corner.
Allow restricted settingsStep 3. Prove it is you
If the phone has a screen lock, Android asks for your PIN, pattern or fingerprint. Then it confirms:
Restricted settings allowed for [the app]Step 4. Go back and switch the permission on
Now you reach Android's own warning, the one every app gets. For accessibility it reads:
Allow [the app] to have full control of your device?Still a real choice. Saying no here is fine, and every permission can be switched off again in Settings.
If the option still isn't there, check these three things:
- The app came from Google Play. There is nothing to allow, because store installs are not restricted. If its switch is still greyed out, look at the managed-phone case below.
- Your phone maker moved it. Menus differ between Samsung, Xiaomi, OnePlus and others. Look through the whole App info page as well as the menu.
- Your phone is managed. A work or school policy can block accessibility services outright, and only that organisation can change it.
What if you already said yes to an app you now doubt?
Move quickly, in this order. Switch off the app's accessibility, notification access and SMS permission in Settings, then uninstall it. Search Settings for Install unknown apps and switch it off for WhatsApp, your browser and your file manager; Android has asked for that per app since Android 8 (Android Developers).
Then call your bank on a number from its official website, never one from the message, and ask what to block. RBI's advice is to report financial cyber fraud at cybercrime.gov.in or on the 1930 helpline.
Keep Play Protect on afterwards. Google recommends leaving it on all the time (Google Play Help).
Where Ledgerly fits
Ledgerly asks for SMS to read bank alerts, notification access to catch UPI payments that never arrive as a text, and accessibility to read order screens in a set list of shopping and food delivery apps. So it declares all four of the permissions Play Protect's India block looks for. It does not ask for the ones an expense tracker has no use for: sending texts, placing calls or installing other apps.
When we planned how Ledgerly would reach people, Google's rule settled it. A Ledgerly file passed around on WhatsApp would look just like the scams the India block was built to stop, and the block would be right to stop it. So Ledgerly is coming through Google Play, where it is in closed testing now.
Installed from Play, neither gate applies. You get Android's normal permission screens, you can refuse any of them, and manual entry works without them. What each permission is used for, and what stays on your phone, is set out in the privacy policy, and the Ledgerly FAQ answers why it needs SMS at all.
Until it opens up, you can try Ledgerly's order capture in your browser, where a simulated Swiggy or Zomato order lands in the ledger item by item. You can also leave your email on the waitlist for one message when Ledgerly lands on Google Play, or ask for a beta place.
Common questions
What does allow restricted settings mean?
It is a per-app option on Android 13 and later. Choosing it lets an app you installed from a downloaded file ask for accessibility and notification access, and on Android 15 and later the SMS permission too. You still grant each permission yourself afterwards.
Is it safe to allow restricted settings?
Only if you trust the developer, which is Google's own advice. In practice that means an app you went looking for, from a developer you can find outside the file itself, asking for permissions that match its job, with nobody on a call or in a chat waiting for you to do it. If any of that fails, uninstall the app.
Why is the SMS permission greyed out on my phone?
On Android 15 and later, SMS is a restricted setting for apps installed from a downloaded file. Apps installed from Google Play are not restricted. If you are sure about the app, tap the greyed-out switch once, then use Allow restricted settings from the three-dot menu on its App info page.
Why don't I see Allow restricted settings?
Android adds it to the app's three-dot menu only after you have tried to switch on a locked permission and seen Android's message for that app ("Restricted setting", or "App was denied access" for SMS on Android 15 and later). Tap the greyed-out switch once, go back to App info and open the menu. If it is still missing, the app came from Google Play and isn't restricted, your phone maker moved the option (look through the whole App info page), or a work or school policy manages the phone.
Can I install an app that Play Protect blocked?
Google built this block to stop the install, and its advice is to keep Play Protect on. Ours is the same. If the app is real, ask its developer for a Google Play link; a developer who thinks the block is a mistake can appeal to Google.
I gave a suspicious app these permissions. What now?
Switch off its accessibility, notification and SMS access in Settings, then uninstall it. Call your bank on a number from its official website, not one from the message. RBI says to report financial cyber fraud at cybercrime.gov.in or on the 1930 helpline.