WhatsApp Unveils New Scam Alert Feature

What happened

The brief is thin and mixes WhatsApp with Signal. I’ll pull the SecurityWeek piece and official product notes so the paragraphs stay factual and specific.The SecurityWeek piece and Signal’s blog have the product mechanics. I’ll read those next and keep names and numbers only from those sources.Meta’s engineering post is the primary source for hashes, ledgers, and the federated pipeline. I’ll pull that next so the mechanics stay exact.WhatsApp has begun a limited beta rollout of Scam Alert, an optional feature that uses an on-device machine learning model to flag suspicious messages from non-contacts. SecurityWeek reported that classification happens entirely on the device, with no automatic reporting to WhatsApp or parent company Meta. Meta published the matching engineering write-up as an early technical preview and said the feature will keep changing on researcher and user feedback before any wider rollout. The same SecurityWeek article also covered Signal’s automatic key verification, a feature built to complement Signal’s existing safety number system rather than replace it.

Once a user turns Scam Alert on, the app downloads a model trained on patterns from scam conversations that users have already reported. The model then scores incoming messages from people who are not in the address book, using probabilistic classification on conversational structure and linguistic cues. If a message is flagged, only the recipient sees a warning inside the chat. The sender is not notified. The recipient can block the contact, report the message, ignore the warning, or mark the conversation as trusted so later alerts on that chat are suppressed. Users who mark a chat as trusted can separately choose to share the last five messages they received, which is the only content-sharing path that is not a standard report. To keep Meta from pushing a special model to a special person, every model release must be logged on a third-party, append-only transparency ledger before it can be distributed. Each release ships with a manifest of SHA-256 hashes covering the model weights and related files. The digest of that manifest is signed with Ed25519 keys held by Cloudflare, not by Meta. The device checks the signature, checks the ledger, and checks that the downloaded files match the published hashes before the model is allowed to run.

The technical detail

Because no message text leaves the phone for classification, WhatsApp still needs a way to tell whether the feature is catching scams or just firing noise. It built a confidential federated analytics pipeline that is allowed to collect only two categories of data: counts of how often warnings were triggered, and counts of what action users took afterward, such as blocking or marking a chat as trusted. Those counts are processed inside confidential virtual machines, a form of trusted execution environment, and released only as differentially private aggregates. Clients send the metrics through an OHTTP relay that strips IP addresses and authenticate with anonymous credentials so the server cannot tell which user is talking. Assignment of experimental model variants happens on the device with locally generated randomness, which is the other half of the no-targeted-delivery rule. WhatsApp’s stated threat model covers external attackers, compromised infrastructure insiders, and supply-chain risk, and the company says that targeting one user’s data would require compromising the entire system. Users can open a transparency log at Account, Request Info, Scam Alert Activity to see which messages were scanned, what the outcome was, and which model version made the call. WhatsApp is also expanding its bug bounty program to cover Scam Alert, and researchers already stress-tested the system ahead of the beta.

Why it matters for builders

For engineers, the product is less interesting as a warning banner than as a constraint set enforced in the download path. Server-side scanning of chat text would break the end-to-end encryption contract WhatsApp sells. Doing nothing leaves users open to impersonation and AI-generated lures that the operator cannot read. An optional, on-device classifier that the user can turn off, that never auto-reports, and that cannot be silently swapped for a targeted model is the third design. Publishing the weights, putting the signing keys at Cloudflare, and giving the user a per-message scan log are the parts other teams should copy if they ship a similar classifier next to private data. The last-five-messages opt-in after a trusted mark is the part they should treat as a consent surface, not as free training data.

The SecurityWeek pairing with Signal is the right market frame. WhatsApp is trying to label social-engineering content without decrypting it on a server. Signal is trying to detect a public-key swap in its directory without forcing two people to compare safety numbers in person or over a second channel. Signal’s automatic key verification is built on key transparency: a cryptographically verifiable log of every registration, phone number change, and username change. Cloudflare and Trail of Bits audit that log. Identifiers and keys in the log are obscured with a verifiable random function and a keyed hash function, so the auditors never see plaintext user data. A user starts a check from a connection’s profile by opening View Safety Number and tapping Verify automatically under Automatic Key Verification. A green checkmark that reads Encryption verified is the success state. The feature is opt-out. Anyone who does not want to rely on Signal or its auditors can turn it off under Privacy, Advanced, Automatic Key Verification and keep using manual safety numbers.

Market and competitive context

What to watch next is narrow. On WhatsApp, watch whether outside researchers use the expanded bounty and the published weights to show the model is purpose-built for scam detection and nothing else, and watch whether the federated pipeline stays limited to those two count categories once the preview ends. Watch how often users take the last-five-messages opt-in after marking a chat trusted, because that is the only quiet path for content to leave the device. On Signal, watch whether people actually tap Verify automatically, or whether the new button sits unused the way most safety-number scans already do. The beta will also show whether the in-app Scam Alert Activity log is complete enough for a user to reconstruct what was scanned and which model version did the work.

What to watch next

The architecture does not close every risk. A classifier trained on reported scams inherits the coverage gaps of those reports, and a sender who is never told they were flagged can rewrite copy until the warning stops. Targeted model delivery is the threat WhatsApp spent the most design effort on, and the ledger plus Cloudflare signatures plus on-device experiment assignment are a serious attempt to close it, but the device still has to believe it is checking the same ledger everyone else checks. Signal’s open-source key transparency server is the closest prior art for that consistency problem. Client-side classifiers on private data still draw scrutiny even when the operator says no content leaves the phone. WhatsApp is inviting that scrutiny before a full rollout, which is the correct order. Whether Scam Alert stays optional, whether Cloudflare keeps the Ed25519 keys, and whether the transparency log stays complete after the preview are the checks that matter once the beta is no longer small.