WhatsApp Enhances User Security with Scam Alert
WhatsApp has initiated a restricted beta rollout of its innovative Scam Alert feature, aimed at identifying potentially fraudulent messages from unknown contacts. This optional tool leverages an on-device machine learning model to analyze messages for scam-related patterns, thereby complementing the platform’s end-to-end encryption.
How Scam Alert Works
Once activated, the Scam Alert feature downloads a model onto the user’s device to scrutinize incoming messages for linguistic and structural cues indicative of scams. Notably, this process occurs entirely on the device, ensuring that no data is reported back to WhatsApp or its parent company, Meta.
When a message is identified as suspicious, a warning appears only to the recipient, leaving the sender unaware. Users can then choose to block the contact, report the message, ignore the alert, or mark the conversation as trusted, which will suppress future warnings. Users opting to mark a chat as trusted may also share recent messages to enhance the feature’s accuracy.
Security and Transparency Measures
To maintain integrity and prevent targeted deployments, WhatsApp employs a third-party, append-only transparency ledger to log every model release. A manifest filled with SHA-256 hashes of model weights and files accompanies each release, verified using Ed25519 keys maintained by Cloudflare.
Verification is further supported by a user-accessible transparency log, detailing scanned messages and model versions. This can be accessed through the app via Account > Request Info > Scam Alert Activity.
Evaluating Feature Effectiveness
WhatsApp has developed a confidential federated analytics pipeline to assess the Scam Alert’s performance. This system collects data on warning frequency and user responses, such as blocking contacts or marking chats as trusted, while ensuring individual user data remains secure.
The company has also expanded its bug bounty program to include Scam Alert, inviting researchers to contribute to its development. This release is an early technical preview, with plans for future refinements based on feedback.
Signal’s New Automatic Key Verification
In parallel, Signal has launched automatic key verification to enhance its safety number system. This feature autonomously checks for unauthorized parties in encrypted conversations, eliminating the need for manual verification through meetings or secondary channels.
Automatic key verification ensures that a Signal account’s public key matches the owner’s, preventing potential compromises. This is supported by a transparent log, audited by Cloudflare and Trail of Bits, that records changes in registrations and user details.
While the feature is enabled by default, users can opt-out via Privacy > Advanced > Automatic Key Verification, relying on manual checks if preferred.
Both WhatsApp and Signal’s advancements underscore ongoing efforts to bolster user privacy and security in digital communications.
