WhatsApp has begun rolling out a new optional feature designed to warn users when they may be targeted by scammers, using an on-device machine learning model rather than sending message data to external servers.
The feature, called Scam Alert, is currently available as part of a limited beta rollout, with WhatsApp testing the system alongside researchers from its Bug Bounty community before any wider release.
"Today, we're sharing an early look at Scam Alert, a new, optional feature that runs an on-device machine learning model to alert a user about potential scam messages," WhatsApp said. "No message content leaves the device for classification or is auto-reported to WhatsApp, Meta, or anyone else. The feature complements end-to-end encryption while enabling a user-controlled, optional scam alert when the model believes there's a likely scam."
According to the company, the underlying model has been trained on scam conversations that users have previously reported. It is designed to assess incoming messages from non-contacts to determine whether they match known scam patterns, using linguistic signals and probabilistic classification based on the structure of the conversation.
If the model identifies a potential scam attempt, the user is shown a warning within the chat, giving them the option to block the sender, report the conversation, or continue messaging despite the alert.
WhatsApp said users retain control over how the feature behaves if they believe a warning has been triggered incorrectly. "If they decide that a warning is incorrectly flagged, the user can mark the chat as trusted, in which case the warning is removed and Scam Alert will not flag that chat again," the company said. Users who mark a chat as trusted can also choose to share the last five messages received with WhatsApp, an opt-in step intended to help improve the accuracy of the detection model.
WhatsApp has stressed that both the message data processed by the local model and the model itself remain on the user's device, and that the Scam Alert feature can be switched off at any time.
The rollout forms part of a wider set of measures the company has introduced over the past year aimed at helping users identify fraud attempts before they engage with a scammer. In March, Meta said WhatsApp would begin warning users when behavioural signals suggested that a device-linking request might be fraudulent, addressing a common tactic used to hijack accounts by tricking people into scanning a malicious QR code or sharing a linking code.
Two months earlier, WhatsApp had started introducing "Strict Account Settings," a lockdown-style security feature intended to protect journalists, public figures and other high-risk individuals from sophisticated threats, including spyware attacks. That feature followed a series of incidents in which journalists, activists and political figures had their devices infected with spyware, including NSO Group's Pegasus, through messaging apps such as WhatsApp. Some of these attacks involved zero-click exploits, which allow attackers to compromise iOS and Android devices without any interaction from the user.
WhatsApp is used by more than 3 billion people across over 180 countries to communicate with family and friends, making it a frequent target for scam and fraud campaigns as well as more sophisticated surveillance attempts.
The introduction of Scam Alert reflects a broader industry focus on tackling fraud that occurs after initial contact with a user, rather than relying solely on measures that prevent unauthorised access in the first place. Security researchers have noted that once attackers have obtained valid credentials or established contact with a target, traditional prevention measures become less effective, underscoring the value of tools that operate at the point of interaction, such as within a chat itself.
WhatsApp's approach of processing data locally, rather than transmitting message content for analysis elsewhere, is intended to allow the platform to offer scam detection without undermining the end-to-end encryption that protects the content of user conversations.
The company has not indicated when Scam Alert might move beyond its current limited beta testing phase or become available more widely to its global user base.
