WhatsApp is rolling out a new feature called Scam Alert. The tool aims to warn users about potential scam messages. It works without breaking the app’s end-to-end encryption.

The company announced the feature in a technical blog post. It is currently in limited Beta testing. WhatsApp says it will keep refining the tool before a wider release.

What Scam Alert Does

Scam Alert runs an on-device machine learning model. The model checks incoming messages from non-contacts. It looks for patterns that match known scam tactics.

Importantly, no message content leaves the device for this analysis. WhatsApp says the system does not auto-report anything to the company. Users must take action themselves for any data to be shared.

If the model flags a message as a likely scam, the user sees a warning. The warning appears only in their own chat. The other person does not see it.

From there, users can choose to block the sender, report the message, or continue the conversation. If a warning seems wrong, users can mark the chat as trusted. After that, Scam Alert will not flag that conversation again. Users who mark a chat as trusted can also choose to share the last five messages with WhatsApp, in order to help improve the model.

Privacy Safeguards Built In

WhatsApp designed Scam Alert around three core principles. First, all processing happens on-device. Second, there is no automatic reporting. Third, users stay in control and can turn the feature off at any time.

To measure whether the feature works, WhatsApp collects limited telemetry. This includes only aggregate counts, such as how many warnings appeared and what actions users took. That data passes through a confidential federated analytics pipeline before reaching WhatsApp.

The pipeline runs inside Trusted Execution Environments, or TEEs. These are secure hardware environments that even Meta and WhatsApp cannot access directly. Data is encrypted in transit and processed anonymously. Differential privacy noise is added to the final numbers, so no individual user can be identified.

Additionally, all traffic is routed through a third-party OHTTP relay. This relay strips identifying information like IP addresses. As a result, WhatsApp says no one can trace collected data back to a specific device or user.

No Targeted Model Delivery

Another key safeguard involves how the scam-detection model itself reaches phones. WhatsApp says neither the company nor Meta can send a specific model version to a specific user.

Every model version is published on a public, third-party transparency ledger before deployment. This includes experimental variants used for testing. The ledger is tamper-evident, meaning entries can be added but never changed or deleted.

Download requests are also anonymous. They pass through the same OHTTP relay, and devices assign themselves to experiment groups using local randomness. Therefore, the server cannot steer any particular user toward a particular model.

Verifying Model Behavior

WhatsApp also wants outside researchers to check its work. The company has published model weights so that independent experts can confirm the model is built only to detect scams.

Users, meanwhile, can view their own transparency logs. These logs show which messages were scanned, what the outcome was, and which model version made the decision. This information sits under Account > Request Info > Scam Alert Activity.

WhatsApp has already engaged external researchers through its Bug Bounty program. These researchers reviewed an early build of the app to confirm no message content leaves the device. Others examined the model itself to verify it serves no purpose beyond scam detection. WhatsApp plans to expand this bug bounty scope further as the feature develops.

Looking Ahead

Scam Alert remains in early Beta. WhatsApp says it will continue testing and refining the feature based on feedback from users and security researchers.

The company describes scam tactics as constantly evolving, from impersonation to AI-generated lures. In response, WhatsApp says it intends to keep updating Scam Alert to stay ahead of new threats, while continuing to protect the privacy guarantees at the core of its encrypted messaging platform.

Related post

View all