WhatsApp's Scam Alert feature uses an on-device machine learning model to identify potentially scammy messages from unknown contacts without compromising end-to-end encryption. The model is verified via a third-party append-only transparency ledger with cryptographic signatures to prevent targeted model manipulation. User interactions with warnings are collected through a confidential federated analytics pipeline that only gathers aggregate counts of warnings and user actions, preserving privacy. Users can review transparency logs of scanned messages and model versions. The feature is currently in limited beta and considered an early technical preview. Signal's automatic key verification complements its safety number system by cryptographically verifying public key registrations and changes via a key transparency log audited by independent parties, helping detect man-in-the-middle attacks without requiring manual checks.

This feature enhances user protection against scam messages by providing real-time, privacy-preserving warnings on suspicious content from unknown contacts. It improves user awareness and control without exposing message content or user data to WhatsApp or Meta. The transparency and cryptographic verification mechanisms reduce risks of targeted manipulation or supply chain attacks on the machine learning model. Signal's automatic key verification reduces the risk of undetected man-in-the-middle attacks by automating key verification with cryptographic proofs and independent auditing. Both features strengthen the security posture of encrypted messaging platforms without degrading privacy.

This is a new security feature designed to help users detect scam messages and verify encryption keys. Users should consider enabling WhatsApp's Scam Alert feature during its beta to benefit from on-device scam detection. No specific vulnerability remediation is required as this is a protective feature rollout. Signal users can enable automatic key verification to improve detection of unauthorized key changes. Since these are new features in beta or opt-out states, users should follow official guidance and updates from WhatsApp and Signal. No immediate action is required to mitigate a vulnerability or exploit.