"Today, we're sharing an early look at Scam Alert, a new, optional feature that runs an on-device machine learning model to alert a user about potential scam messages," WhatsApp said.
How Scam Alert works
WhatsApp's new Scam Alert option runs a machine learning model locally on a user's device to flag messages that resemble known scam patterns. According to the company, the model is trained on scam conversations reported by users and evaluates incoming messages from non-contacts using linguistic signals and probabilistic classification based on conversational structure. When the model detects what it considers a likely scam attempt, the chat displays a warning that gives the user three choices: block the sender, report the chat, or continue the conversation.
The feature is explicitly optional. If a user believes a warning was incorrect, they can mark the chat as trusted; doing so removes the warning and prevents Scam Alert from flagging that conversation again. Users who mark a chat as trusted may also opt in to share the last five messages received in that chat with WhatsApp to help improve the feature's accuracy.
On-device modelling and privacy claims
WhatsApp emphasizes that the classification happens on-device. "No message content leaves the device for classification or is auto-reported to WhatsApp, Meta, or anyone else," the company said, and it added that the message data processed by the local model and the model itself never leave the device. The firm also noted that the feature complements end-to-end encryption and that users can disable Scam Alert at any time.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildLimited beta with Bug Bounty researchers
The rollout is currently a limited beta while WhatsApp tests the warning system with researchers in its Bug Bounty community. The company framed this as an early look at the capability rather than a full-scale launch. That staged approach places the work of refining classification models and warning heuristics into the hands of a smaller group before a broader user-facing release.
How Scam Alert fits with prior WhatsApp security changes
Scam Alert joins a series of recent changes WhatsApp has rolled out to block fraud before users engage. In March, Meta announced that WhatsApp would warn users when behavioral signals suggest a device-linking request may be fraudulent — a tactic commonly used to hijack accounts by tricking users into scanning a malicious QR code or sharing a linking code. Two months earlier, WhatsApp began rolling out "Strict Account Settings," described as a lockdown-style security feature meant to protect journalists, public figures, and other high-risk individuals from sophisticated threats, including spyware attacks.
WhatsApp said the Strict Account Settings feature arrived after many journalists, activists, and political figures had their phones infected with spyware — including NSO Group's Pegasus — via messaging apps in attacks that used zero-click exploits, which can hack iOS and Android devices without user interaction.
What this means for end users, security teams, and high-risk individuals
- End users: Scam Alert is opt-in and will present a visible warning for messages from non-contacts that match known scam patterns. Users can mark chats as trusted or share the last five messages to help improve accuracy; the feature can be disabled at any time.
- Security teams and researchers: The local, on-device approach aims to preserve end-to-end encryption while allowing client-side classification; the limited beta with Bug Bounty researchers is positioned to surface false positives and tuning needs before wider deployment.
- Journalists, activists, and public figures: WhatsApp's earlier "Strict Account Settings" and device-linking warnings remain the company's directed protections for people at higher risk of targeted spyware and account-hijacking techniques such as fraudulent device-linking requests and zero-click exploits.
WhatsApp's messaging service reaches a large user base — the company says it is used by over 3 billion people from more than 180 countries — and Scam Alert is framed as one more tool aimed at reducing successful social-engineering and scam campaigns without transmitting message content off-device. The product's final accuracy, adoption rate, and impact will depend on outcomes from the limited beta testing and any subsequent refinements based on opt-in data sharing and researcher feedback. Will that staged testing and the limited telemetry WhatsApp permits be enough to tune the models before a wider rollout? That is the practical question the company and its test community will address next.
