DeepMind and Singapore build an on-device scam detector that never reads your chats in the cloud

Scam detection usually means sending messages to a server, which is exactly what people worry about when the messages are their private conversations. Google DeepMind and Singapore's GovTech took a different route with a fine-tuned Gemma model that runs on the phone and watches for the manipulation patterns common in social engineering: someone impersonating a bank, a government office, or a local official, or pushing a trending investment or job scam. When it spots manipulation, it shows a warning that tells the user to pause before sending money or sensitive information.

The engineering detail worth copying is the two-stage design, meant to protect battery life. A lightweight classifier screens incoming messages first, and only when something looks suspicious does the larger fine-tuned Gemma model read a bigger slice of the conversation to confirm or dismiss the alert. Because everything happens locally, neither Google nor the government can see the chats, and the model only runs on conversations the user has consented to under each app's terms. Fine-tuning was done inside GovTech's managed cloud environment, trained on anonymised scam reports with personal data excluded and tested on synthetic dialogues.

The context explains the effort. Scams such as investment fraud, fake job offers, and official impersonation make up over half of Singapore's reported crimes, with losses above S$4 billion since 2019, and social engineering accounts for up to 80% of those losses. The blog gives no accuracy numbers, which is the main thing to watch for.

Why it matters

If you build consumer AI features that touch private messages, this is a concrete template for keeping the sensitive data on the device while still running a capable model. The missing accuracy figures mean the real test, how often it cries wolf or misses a real scam, is still unproven.