WhatsApp scanning your messages for scams sounds like a privacy nightmare. But the way the company has built this feature is actually more thoughtful than you might expect, and that’s worth paying attention to.
According to WABetaInfo, WhatsApp is currently testing a feature called Scam Alert with a limited number of Android beta testers running version 2.26.34.2. The feature uses a machine learning model that runs entirely on the user’s device. No message content is sent to WhatsApp’s servers, Meta, or any third party during analysis. That means it is, at least technically, compatible with end-to-end encryption.
Here’s how it works in practice. When a message arrives from an unknown contact, the on-device model checks it against patterns associated with known scams. If something looks suspicious, WhatsApp shows a warning inside the chat that reads “This may be a scam.” The sender never sees this warning. From there, the user can block and report the contact, which also sends a flag to WhatsApp, or mark the chat as trusted to dismiss the alert entirely. The feature is off by default and lives in the account settings screen, where it can be disabled at any time.
Meta has also published an engineering blog post laying out the privacy architecture behind Scam Alert, and some of the details are genuinely interesting. The same model is distributed to every user, which means Meta cannot send a tailored or modified version to a specific person. Every model version is recorded on a public transparency log before it reaches any device. When a device requests a model update, the request is routed through a relay that strips the user’s IP address, so the server cannot identify who is asking. The app also checks the model’s integrity before installing any update. And Meta has expanded its Bug Bounty program to include Scam Alert, inviting external security researchers to verify that the model only does what Meta says it does.
That last point matters. Bug bounty programs are not a guarantee, but they are a meaningful signal. Opening the system to outside scrutiny is a better answer than simply asking users to take Meta’s word for it.
Still, some caveats are worth keeping in mind. This is a beta feature with a narrow rollout. WhatsApp has not said when it will reach all users, and there is no iOS release date yet. The system can produce false positives, and when it does, WhatsApp gives users the option to share the last five messages from that conversation to help improve the model. That sharing is optional, but it’s the clearest moment where data moves off your device. Users who care about that should know the choice is coming.
There is also a broader context here. Scam and fraud messages are a serious and growing problem on messaging platforms globally. WhatsApp has more than two billion users, and a significant number of scams begin with a message from an unknown number. Regulators in markets like the UK and EU are putting real pressure on platforms to do more about fraud. So WhatsApp building this now is not purely altruistic. It also helps the company stay ahead of legal obligations.
- Scam Alert is off by default and must be enabled manually in account settings
- The on-device model analyzes messages locally without sending content to Meta’s servers
- Users can block and report a flagged contact, or mark the chat as trusted
- An on-device activity log shows what the feature has flagged and which model version is running
- Model updates happen in the background and are verified against a public transparency log
- Sharing messages to help improve the model is always optional
The privacy architecture here is more rigorous than what most companies offer when they add AI-driven moderation to a messaging app. That said, “more rigorous than usual” is not the same as “completely trustworthy.” Meta’s track record on privacy gives reasonable people good cause to read the fine print carefully. For now, Scam Alert looks like one of the better-designed attempts at this kind of on-device safety feature. Whether the execution matches the engineering writeup is something independent researchers will need to verify.