AbstractSmart‐phones have become a necessity for users due to their abundance of services such as global positioning system, Wi‐Fi, voice/video calls, SMS, camera, and so forth. It contains personal information of users including photos, documents, messages, and videos. Android‐based smart‐phones enriched with many applications (commonly known as apps) fascinates users to use this ubiquitous technology up to a full extent. With open architecture and 73% of market share, Android is the most popular mobile operating system (OS) among developers. At the same time, the increasing popularity of Android OS woos attackers or cyber‐criminals to exploit its vulnerabilities. The attackers write malicious code to harm the device and grab users' sensitive information. For example, ransomware (a form of malware) demands ransom from victims to liberate the ceased material for illegal financial gain. The existing survey papers cover the analysis and detection of generic Android malware. The focus of this survey paper is to present an in‐depth threat scenario of Android ransomware. This article not only provides a comprehensive survey on analysis and detection methods for Android ransomware since its beginning (2015) till date (2020); but also presents observations and suggestions for researchers and practitioners to carry out further research.