You get a WhatsApp message from an unknown number. It’s polite. It feels urgent. It asks for “a quick favor.” That’s the moment most people slip: you reply before you think. WhatsApp’s new Scam Alert is built for that exact gap between curiosity and caution. It runs an on-device model that checks suspicious chats from non-contacts and warns you before you engage—without sending your message content to WhatsApp/Meta by default .
What WhatsApp Scam Alert is (and why it’s different)
WhatsApp Scam Alert is meant to catch you in that split second when you’re about to reply to a stranger and your brain goes, “Maybe it’s fine.” It’s a new, optional safety feature that warns you about potential scam messages—especially in chats from non-contacts—before you engage. WhatsApp is rolling it out in a limited beta, testing it with researchers from its Bug Bounty community before broader release .
Here’s the core promise: Scam Alert uses an on-device AI / local machine learning model to look at incoming messages and decide if the pattern looks like a likely scam. If it does, WhatsApp shows a warning so you can make a safer call before you give the scammer what they want: your attention .
The “different” part: it runs on your phone, not in the cloud
Most people hear “AI scam detection” and assume their messages are being shipped off to a server for analysis. WhatsApp is saying that’s not what’s happening here.
- Classification happens on-device (on your phone)
- No message content leaves the device for classification
- Messages aren’t auto-reported to WhatsApp/Meta just because you got a warning
That privacy design matters because WhatsApp is end-to-end encrypted. Scam Alert is positioned as a way to add an extra safety layer without weakening that basic promise—your chats stay private by default, while you still get a WhatsApp scam warning when the system thinks you’re being targeted .
What it’s trying to stop (in plain language)
Scams on WhatsApp usually work because they push you into fast, emotional replies: urgency, fear, guilt, “quick favor,” “you need to act now.” Scam Alert is built to interrupt that rhythm with a pause button—before the chat turns into “Can you share the code?” or “Can you send money?”
It’s not saying every unknown message is a scam. It’s saying: “This looks like one. Slow down.”
How the on-device model decides a message feels “scammy”
That warning doesn’t pop up because WhatsApp “knows” someone is a scammer. It pops up because a local model sees patterns that often show up in scams and assigns a risk level.
WhatsApp says the Scam Alert model is trained on scam conversations reported by users . From there, it checks whether an incoming message from a non-contact matches known scam patterns using two big buckets of signals: linguistic cues and conversational structure .
1) Linguistic cues (what the message “sounds like”)
This is the language layer. The model looks for wording that shows up again and again in scam attempts—without needing to “understand” the whole story like a human would.
Common examples of cues (high-level, not a checklist you can game):
- Urgency and pressure (“right now,” “last chance,” “don’t tell anyone”)
- Requests for sensitive actions (send money, share a code, click a link, scan something)
- Social engineering framing (a favor, a problem, a risk, a fast fix)
It’s basically pattern matching on how scams are usually written.
2) Conversation-structure patterns (how the chat unfolds)
Scams have a rhythm. Even when the script changes, the “shape” of the conversation stays similar: a quick hook, a push to act, then escalation.
WhatsApp describes this as probabilistic classification based on conversational structure —meaning it looks at how the exchange is progressing, not just one line in isolation.
3) It’s probabilistic, so expect some misses
This part matters. WhatsApp frames Scam Alert as probabilistic classification . Translation: it’s judging likelihood, not proving intent.
So yes, you can see:
- False positives (a legit message gets flagged)
- False negatives (a scam slips through)
The right mindset is: treat the alert like a smoke detector. It can’t tell you exactly what’s burning, but it’s worth taking seriously before you “just reply.”
What you’ll see when a chat gets flagged (and the safest way to react)
When WhatsApp Scam Alert thinks an incoming chat looks risky, it doesn’t hide it quietly. It shows a chat warning with clear actions and puts the decision on you: block, report, or continue .
That moment matters. Scammers win when they keep you moving fast.
The three buttons, in plain English
- Block: cuts the sender off immediately. Use it when the message is clearly pushing you into a risky action.
- Report: sends a signal back to WhatsApp that this chat is abusive/scammy (and helps train defenses over time). Use it when you’re confident it’s malicious.
- Continue: keeps the chat open if you believe it’s safe to proceed.
A 20-second decision flow (do this before you type anything)
1) Scan the “ask.” What do they want from you?
If it’s any of the following, don’t negotiate with it:
- Money (payment, crypto, “fees,” reimbursements)
- Codes (OTP, verification codes, “6-digit code”)
- QR / linking prompts (scan this, link your device, confirm login)
- Urgency (time pressure, threats, “right now” language)
Action: Block + Report. Don’t reply. Don’t “explain.” Don’t click.
2) If it might be real but it’s unexpected, verify out-of-band
Maybe it’s a genuine person who got the wrong number. Maybe it’s someone you know with a new number. Either way, don’t verify inside the same chat.
Pick one:
- Call the person using a number you already have (old thread, contact card, company site)
- Message them on a different channel you’ve used before
- If it claims to be a business, check the official website/support path (not the link they sent)
3) If you choose “Continue,” keep your guardrails on
- Don’t share one-time codes
- Don’t move to a different app because they asked
- Don’t send money “just to test”
- Don’t scan QR codes from strangers
This isn’t about being paranoid. It’s about refusing to act on pressure. WhatsApp gives you the warning and the block/report/continue choice for a reason .
Mark as trusted, opt-in sharing, and turning it off (controls that matter)
If WhatsApp Scam Alert flags a chat and you’re sure it’s a false alarm, you’re not stuck living with that warning forever. WhatsApp built in a few controls that let you override the system, share a little signal (only if you want), or shut the feature down completely.
Mark a chat as trusted (the “stop warning me about this one” switch)
If a warning is incorrectly flagged, you can mark the chat as trusted. WhatsApp says that does two things: the warning is removed, and Scam Alert won’t flag that chat again .
This is useful when:
- It’s a real person you’ve verified, but they’re using a new number
- It’s a legit business conversation that just looks “scammy” on the surface
- You’re in a community/group context where unknown numbers are normal
Be selective. Trust is sticky.
Opt in to share the last 5 received messages (accuracy vs. privacy)
After you mark a chat as trusted, WhatsApp says you can also opt in to share the last 5 messages received to help improve Scam Alert’s accuracy .
A practical way to think about that choice:
- If you care most about privacy, don’t opt in. You still get the protection features.
- If you care most about improving detection, and you’re comfortable sharing a small slice of context, opt in.
Key detail: it’s opt-in, not automatic .
Disable Scam Alert anytime (you’re in control)
Not everyone wants AI warnings in their messaging app, even if they’re well-intentioned. WhatsApp says you can disable Scam Alert at any time .
If you turn it off, keep one habit: treat unknown WhatsApp chats like unknown email. Slow down, verify, then respond.
And if you’re in situations where you often have to share contact details with strangers (marketplace deals, rentals, networking), it helps to reduce what scammers can do with your number in the first place. Tools like Cloaked are practical here: you can share a masked phone number or email, then shut it off if it starts attracting spam—clean boundaries, less exposure.
Where Scam Alert fits in WhatsApp’s bigger anti-scam push (and what you should still do)
Scam Alert is one layer. WhatsApp’s broader direction is pretty clear: stop the scam before you interact, not after you’ve already sent the code or scanned the QR.
1) Stopping account hijacks: fraudulent device-linking warnings
One of the nastier WhatsApp scams isn’t a “send money” pitch. It’s an account takeover.
Meta has said WhatsApp will warn users when behavioral signals suggest a device-linking request may be fraudulent—a tactic used to hijack accounts by tricking people into scanning a malicious QR code or sharing a linking code .
If you remember one rule: treat linking like a password reset. If you didn’t initiate it, assume it’s hostile.
2) Hardening for higher-risk people: Strict Account Settings
WhatsApp has also rolled out Strict Account Settings (described as a lockdown-style security feature) aimed at journalists, public figures, and other high-risk users . It’s framed as protection against sophisticated threats, including spyware attacks .
If your job or visibility makes you a target, this kind of “tighten everything” mode matters.
A grounded anti-scam checklist (what still works)
Use Scam Alert, but don’t outsource your judgment.
- Lock down your account
- Turn on the strongest security options WhatsApp offers for your profile.
- Treat any device-linking prompt you didn’t start as a red alert .
- Handle unknown chats like unknown email
- No rushing. No “just answering once.”
- Never share one-time codes, login confirmations, or anything tied to account access.
- Reduce what strangers can do with your real contact details
If you often post in public groups, sell items online, or talk to new people for work, consider using a masking layer like Cloaked for sharing a phone number or email. It’s not a WhatsApp feature, but it’s practical: if a number starts attracting spam or scam attempts, you can stop using that alias instead of burning your real identity.
.png)
