WhatsApp is testing a new way to catch scam messages before they do damage — and it’s doing the analysis entirely on your phone. Meta announced Scam Alert in a technical overview published by its engineering team on August 12, describing it as an early look at an optional feature currently running in a limited beta with WhatsApp’s Bug Bounty security research community.
The pitch is straightforward: warn people about likely scam messages without requiring WhatsApp’s servers to read the content of private conversations.
How Whatsapp Scam Alert actually works
Once a user enables the feature, WhatsApp downloads a machine learning model directly onto their device. That model scans incoming messages from people who aren’t saved in the user’s contacts, looking for language patterns and conversational structures that match previously reported scams. According to Meta’s engineering post, the model is trained on conversations that WhatsApp users have flagged as scams in the past.
If the model flags a message as a likely scam, the recipient sees a warning banner inside the chat. Critically, that warning is only visible to the recipient — the sender has no way of knowing their message was flagged, according to reporting from ConsumerAffairs. From there, the user can block the sender, report the conversation, continue chatting anyway, or mark the chat as trusted, which removes the warning and stops Scam Alert from flagging that particular conversation again.
Users who mark a chat as trusted are also given the option to voluntarily share the last five messages they received with WhatsApp, which Meta says helps improve the model’s accuracy going forward.
Built to keep encryption intact
The detail Meta is leaning on hardest is privacy. In its own words, published to Meta’s engineering blog: “No message content leaves the device for classification or is auto-reported to WhatsApp, Meta, or anyone else.” That’s a meaningful claim for an app built around end-to-end encryption, where the entire premise is that not even WhatsApp can read what users send each other.
To back that up technically, Meta says the system draws on its existing PAPAYA federated analytics architecture — a privacy-preserving framework the company previously presented at USENIX NSDI 2025 — along with techniques including confidential computing, Oblivious HTTP, and differential privacy, according to InfoQ’s coverage of the beta. In plain terms, Meta is trying to measure how well the feature performs without ever centralizing the private message data it’s analyzing.
WhatsApp has also built in a transparency layer for users who want to check the system’s work. A local activity log, accessible through Account > Request Info > Scam Alert Activity, shows when Scam Alert was turned on, which messages it flagged, and which version of the model made that call.
Why now
The timing lines up with a genuinely large problem. The Federal Trade Commission reported that consumers lost $2.1 billion to social media scams in 2025, with $425 million of that tied specifically to WhatsApp, according to figures cited by TechRepublic via CNET. WhatsApp has also been dealing with a separate, recently confirmed scam campaign that lets attackers access accounts using a six-digit code rather than a stolen password, as reported by Forbes — a reminder that scammers on the platform are actively evolving their tactics.
Meta isn’t alone in exploring this approach either. Forbes noted that Google has already rolled out AI-powered scam detection for Android users, including real-time warnings for calls and messages that are similarly processed on-device to keep the underlying conversations private. WhatsApp’s Scam Alert looks like Meta’s answer to the same problem, built around the constraint that its own encryption model doesn’t allow it to inspect messages centrally in the first place.
The limits of the current test
Scam Alert is still explicitly an experiment. Meta has been upfront that the beta cannot catch every threat — in particular, scams sent through a contact’s already-compromised account are outside what this version of the system is designed to catch, since it only analyzes messages from senders outside a user’s contact list, according to ConsumerAffairs. Machine learning models can also misfire in both directions: missing a genuinely sophisticated scam, or incorrectly flagging a legitimate conversation as suspicious.Meta says it plans to keep testing the system with security researchers, expand its bug-bounty coverage around the feature, and refine the underlying model before making any decision about a wider rollout. There’s currently no confirmed timeline for when, or if, Scam Alert becomes available to WhatsApp’s broader user base, and no public sign-up process for the beta has been announced.