WhatsApp rolls out Scam Alert beta for unknown-contact messages

WhatsApp has started a limited beta rollout of Scam Alert, an optional on-device machine-learning feature that flags suspicious messages from people who are not in a user’s contacts. The model is downloaded to a device when a user enables the feature and performs all scanning locally.

The model evaluates incoming messages from non-contacts for patterns tied to known scams, using conversational structure and language cues. When a message is flagged, a warning appears only to the recipient inside the chat; the sender is not notified. Recipients can block the contact, report the message, ignore the warning, or mark the conversation as trusted to suppress future alerts for that chat.

All message classification happens on the device so the system works alongside end-to-end encryption. Users who mark a chat as trusted can opt to share the last five messages they received in that conversation with WhatsApp to help improve the model’s accuracy; sharing is voluntary and limited to those recent messages.

Every model release must be logged on a third-party, append-only transparency ledger before it is distributed. Each release includes a manifest of SHA-256 hashes for the model weights and related files; the manifest digest is signed with Ed25519 keys held by Cloudflare rather than Meta. Devices verify the signature, cross-check the manifest against the ledger, and confirm the downloaded files match the published hashes before the model is allowed to run.

Because message content never leaves the device for classification, WhatsApp uses a confidential federated analytics pipeline to measure whether Scam Alert is working. The pipeline collects only two categories of aggregate data: counts of how often warnings were triggered and counts of which actions users took afterward, such as blocking or marking a chat as trusted. The design aims to make isolating a single user’s data difficult without compromising the entire system.

Users can inspect a transparency log in the app at Account > Request Info > Scam Alert Activity to see which messages were scanned, the outcome of each scan, and the model version that made the determination. WhatsApp is expanding its bug bounty program to include the new feature.

The company describes the rollout as an early technical preview. WhatsApp will refine the system during the beta based on feedback from researchers and users before any wider release. Scam Alert is available to a limited set of beta users and no full timeline for broader availability has been announced.

The addition of on-device scam detection follows broader work by encrypted messaging services to add safety and verification tools while keeping message content private. Some services have recently added automated verification systems that record key changes in verifiable logs to help detect account key tampering.