Anti-scam usually means scanning messages in the cloud. WhatsApp goes the opposite way—it puts the scam-detecting AI on the phone itself, so not a single byte of message content leaves the device.
In August 2026, WhatsApp began a limited test of an opt-in anti-scam feature called Scam Alert (reported the same month by Malwarebytes, PCMag, Forbes, and the Meta Engineering blog, with technical analysis from InfoQ). Its core design: classifying messages from non-contacts for scams happens entirely on-device.
1. How It Works
In two parts:
- Real-time detection: Once enabled, when a non-contact sends a message, a small model on the device makes the call based on conversational structure and linguistic signals. The model is trained on patterns from scam conversations previously reported by users. When a message is flagged as a suspected scam, a warning pops up that the sender cannot see; the user can block, report, continue, or mark the chat as “trusted.”
- Performance evaluation: On-device, warning events and user actions are aggregated into counts, relayed via Oblivious HTTP (OHTTP) with anonymous credentials to a confidential virtual machine for processing, with minimum cohort thresholds and differential privacy applied—in the end, WhatsApp only gets approximate aggregate statistics that can’t be traced back to any individual.
2. Why the Design Is So Convoluted
The original reports lay out the pipeline in detail but don’t fully explain the motivation behind all the complexity. Three reasons.
1. On-device = preserving end-to-end encryption. WhatsApp messages are end-to-end encrypted; scanning in the cloud would break the promise that “not even we can see your content.” Running the model on-device means detection happens without decryption—this is a solution choice in the “anti-scam vs. privacy” tradeoff, not a performance choice.
2. Transparency ledger = preventing server-side manipulation. Every model version and its SHA-256 hash is published to a third-party “append-only” transparency ledger before deployment; the client verifies the ledger entry, signature, freshness, and hash before loading a model. This guards against the server picking a specific model variant for a specific user (i.e., it prevents targeted surveillance).
3. Confidential computing + differential privacy = even telemetry doesn’t leak. Even for aggregate statistics alone, everything goes through a confidential VM plus differential privacy, so WhatsApp only gets approximate aggregate data. The “performance evaluation” stage—the most leak-prone link in the chain—is also sealed inside a trusted execution environment.
3. How It Compares
| Dimension | WhatsApp Scam Alert | Google Messages |
|---|---|---|
| Detection location | Message classification entirely on-device | Varies by feature; partly on-device, partly cloud |
| Privacy mechanisms | Confidential computing + differential privacy + OHTTP + transparency ledger | Uses privacy-preserving mechanisms; boundaries not exactly the same |
| Training data | Scam conversation patterns previously reported by users | Not disclosed |
| Model verification | Client verifies SHA-256 hash, signature, and ledger entry | Not disclosed |
The shared goal is to improve scam and phishing detection without handing message content to a server for scanning. But platforms draw the boundaries between on-device, cloud, and telemetry differently—WhatsApp draws a harder line.
4. What It Means for You
- Users who often get messages from strangers: If the feature rolls out broadly, it’s an extra layer of risk warning. It won’t report anything automatically—you decide whether to block, report, continue, or mark the chat as trusted.
- Two caveats: During testing, the model may produce false positives and false negatives; if you opt in to help improve the feature, you will proactively share the last 5 messages of trusted chats.
5. Assessment
Anti-scam is expanding from “real-time cloud scanning” to “on-device pattern recognition”—instant messaging has found a new equilibrium between security and privacy. Meta plans to extend its Bug Bounty program to cover the confidential federated analytics pipeline and to release confidential VM binaries and privacy-related source code components for independent review. This is a signal that “privacy-first architecture” is becoming mainstream security design.