WhatsApp is testing Scam Alert, an optional on-device machine learning feature that warns users when messages from non-contacts match patterns associated with scams. The limited beta was announced with a technical design that keeps message content on the device during classification while using confidential computing, differential privacy, and transparency mechanisms to measure model performance and prevent targeted model delivery. The feature aims to protect users from fraudulent messages without compromising privacy.
Once enabled, Scam Alert downloads a small machine learning model to the device and evaluates incoming messages from non-contacts using conversational structure and linguistic signals. The model was trained on patterns observed in scam conversations from reports users previously sent to WhatsApp, Meta says. If the model identifies a likely scam, the user sees a warning that isn't visible to the sender and can block, report, or continue the conversation. Users can also mark a chat as trusted, after which Scam Alert won't flag that conversation again. They can optionally share the last 5 messages received from a trusted chat with WhatsApp to help improve the feature.
The architecture separates message classification from performance measurement, according to the report. The device aggregates warning events and user actions locally into counts. These metrics are transmitted through an Oblivious HTTP relay using anonymous credentials and processed inside confidential virtual machines, a form of trusted execution environment. The client verifies the code running in the confidential environment and checks privacy parameters before transmitting data. The aggregation process applies minimum cohort thresholds and differential privacy before only approximate population-level statistics are made available to WhatsApp. Meta also treats model distribution as a security boundary—each production or experimental model version and its SHA-256 hash is published to a third-party append-only transparency ledger before deployment. Clients verify the ledger entry, model signature, freshness, and hash before loading a model. Model downloads use anonymous credentials and OHTTP, while experiment assignment occurs locally, preventing the server from selecting a particular model variant for an individual user. Stephanie Lio, Head of AI Product Marketing at WhatsApp, described the Scam Alert design on LinkedIn as "on-device only" and emphasized "no automatic reporting" and that "Users remain in control."
The approach builds on Meta's PAPAYA federated analytics system, which was presented at USENIX NSDI 2025. PAPAYA uses trusted execution environments and on-device processing for privacy-preserving federated analytics, distinguishing analytics workloads from federated learning. Scam Alert applies that foundation to a consumer messaging system where the telemetry itself is treated as sensitive. A comparable approach exists in Google Messages, which provides real-time spam protection for scams and phishing and uses privacy-preserving mechanisms for detection. The implementations differ in their architectural boundaries and the types of processing performed locally or through Google services. The design keeps message content on the device during classification, preventing WhatsApp servers from ever accessing the actual text being evaluated. This addresses a key privacy concern—that scam detection might require companies to read user messages—by moving the entire analysis process onto the user's own hardware.
Meta says the limited beta will allow the company and its Bug Bounty community to stress test the implementation before broader availability. The company is expanding its Bug Bounty program to cover the confidential federated analytics pipeline and will publish the confidential virtual machine binary and privacy-relevant source components for independent security review. The transparency mechanisms—including the append-only ledger and client-side verification—are designed to prevent Meta from deploying different model versions to different users without detection, a safeguard against targeted surveillance. The success of this privacy-first architecture could determine whether users trust automated scam detection enough to enable it, and whether other messaging platforms adopt similar technical guardrails. For enterprise technology leaders, the tension between user protection and algorithmic transparency remains central to product adoption, particularly when detection systems operate invisibly in the background.