WhatsApp Unveils New Scam Alert Feature to Protect Users from Social Engineering Attacks

WhatsApp has announced a new optional feature called Scam Alert, designed to warn users about potential scam messages using an on-device machine learning model, without compromising the platform’s end-to-end encryption.

As scam tactics evolve from simple impersonation to sophisticated AI-generated lures, the Meta-owned messaging platform says its protections must evolve just as fast, and Scam Alert represents its latest step toward that goal.

Once a user enables Scam Alert, the app downloads a lightweight machine learning model directly to the device, where it analyzes incoming messages from non-contacts for conversational structure and linguistic patterns associated with known scams.

Critically, no message content ever leaves the device for classification, and nothing is automatically reported to WhatsApp, Meta, or any third party unless the user explicitly chooses to report it.

If the model flags a message as a likely scam, a warning appears in the chat that is visible only to the recipient, giving them the option to block, report, or continue the conversation, or mark the chat as trusted if they believe the warning was a false positive.

The feature is built around three core principles: on-device-only processing, no automatic reporting, and full user control. To measure whether Scam Alert is actually working, WhatsApp needed some visibility into aggregate performance, so it developed a confidential federated analytics pipeline built on Trusted Execution Environments (TEEs), specifically confidential virtual machines.

This system aggregates only anonymous counts, such as how many warnings were shown and what actions users took, and applies differential privacy noise before any data reaches Meta’s servers.

The attached workflow diagram illustrates this end-to-end process, from on-device data minimization through OHTTP relay job selection, RA-TLS attested orchestrator and aggregator TEEs, to the final output of differentially private anonymized statistics .

A key security concern with any server-delivered model is the risk of targeted delivery, where a bad actor or insider pushes a manipulated model to a specific individual.

Meta addresses this by publishing every model version, identified by its SHA-256 hash, to a third-party append-only transparency ledger before deployment.

Download requests are routed through an OHTTP relay that strips IP addresses and is authenticated via anonymous credentials, so the server cannot determine which user is requesting a model.

The experiment group assignment for testing new model variants also occurs entirely on-device, using locally generated randomness, preventing the server from steering any individual toward a specific model.

WhatsApp’s threat model accounts for external attackers, malicious insiders, and compromised supply-chain vendors. Defenses include TEE code isolation, encrypted DRAM, CVM hardening, and restrictions that prevent even Meta engineers from gaining runtime shell access to the confidential computing environment.

Users can independently audit the system through an in-app transparency log, accessible via Account, Request Info, Scam Alert Activity, which shows which messages were scanned and which model version was used.

WhatsApp is also expanding its Bug Bounty program to include the model weights and the federated analytics pipeline, inviting external researchers to verify that the system is purpose-built solely for scam detection.

Scam Alert is launching first in a limited Beta rollout, with WhatsApp stating it will continue stress-testing the system alongside its security research community before a wider release.

The company also plans to publish a detailed engineering white paper on the pipeline’s design, building on its earlier peer-reviewed PAPAYA Federated Analytics Stack work presented at USENIX NSDI 2025.

This phased approach reflects a broader industry trend of pairing privacy-preserving AI features with independently verifiable transparency mechanisms rather than relying solely on internal assurances.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now