WhatsApp Begins Limited Beta Testing of On-Device Scam Alert to Detect Fraud While Preserving End-to-End Encryption
WhatsApp, owned by Meta, has launched limited beta testing of its Scam Alert feature designed to warn users about potentially fraudulent messages from strangers.
The protection relies on a machine learning model that runs directly on the smartphone. Conversation content is never transmitted to WhatsApp or Meta, preserving end-to-end encryption. After activation, the device downloads the model and examines dialogue structure along with linguistic signs of fraud.
When a message appears suspicious, the recipient sees a warning while the sender remains unaware. Users can then block the contact, file a report, dismiss the alert, or designate the chat as trusted. In the trusted case, the last five messages can optionally be shared to help improve the model.
To prevent Meta from deploying a customized analyzer to specific users, every model release is recorded in an immutable log. A manifest containing SHA-256 hashes is signed with Ed25519 keys controlled by Cloudflare. The smartphone verifies the signature, log entry, and file integrity before executing the model.
WhatsApp collects only anonymized counters of detections and subsequent user actions. The app also includes a Scam Alert Activity log showing check results and model versions.
The current release remains an early technical preview. Meanwhile, Signal has introduced automatic key verification that uses a cryptographically verifiable log and allows users to confirm no unauthorized intermediary is present. Independent audits are performed by Cloudflare and Trail of Bits without access to user data.
Related articles
Google Chrome Blocks Over 7 Billion Unwanted Notifications Daily on Android
Google reported that its Chrome protection systems blocked more than 7 billion unwanted notifications every day on Android during the first quarter of 2026. Websites increasingly use browser notifications to deliver phishing attempts, fraudulent payment requests, and malware. Chrome applies a multi-layer "Swiss cheese" defense model where several overlapping filters compensate for each other's weaknesses. The browser automatically revokes notification permissions from sites that have not been visited recently or that trigger repeated security warnings, and it can also cancel associated subscriptions. For particularly noisy resources, Chrome enforces a hard limit of 1,000 messages per minute and returns HTTP 429 responses to excess traffic. Google also made permission prompts less intrusive on Android, which reduced background activity and improved battery life. Users can review and manage notification permissions through Safety Hub on both desktop and mobile versions of Chrome.
Mail.ru Blocks Phishing Wave Using Password-Protected RAR Archives
Mail.ru's antispam team has stopped a new phishing campaign that relies on password-protected RAR archives. These messages accounted for 13% of all blocked emails over the past month. The attackers impersonate business correspondents by sending contracts, signature requests, and tax-related notifications during the reporting season. Each email contains the archive password in plain text, allowing the recipient to open a malicious executable hidden inside. The malware is designed to steal credentials, grant remote access, or exfiltrate personal and corporate data. Mail.ru's filtering system uses more than 30 machine-learning models and antispam checks to detect such threats. Users are advised to verify senders carefully and avoid launching files from unexpected attachments even when a password is supplied.
Kaspersky Adds Call Filtering to Kaspersky Secure Mobility Management for Android Devices
Kaspersky has introduced call control capabilities into the expanded version of Kaspersky Secure Mobility Management. The new feature allows corporate Android devices running Kaspersky Endpoint Security for Android to check incoming call numbers against both local offline databases and global online reputation sources. Depending on company policy, the system can display warnings to employees or automatically block suspicious calls. Administrators gain the ability to define rules by call category, maintain black and white lists, and apply different policies to specific employee groups. The update targets risks from telephone fraud and social engineering attempts that aim to extract confidential corporate information or funds. It also helps reduce unwanted spam calls that disrupt staff who handle high volumes of incoming communications. Kaspersky Secure Mobility Management provides full lifecycle control over corporate mobile devices, applications, data, and security policies.
Behavioral Anti-Fraud: How Systems Analyze User Actions Beyond Device and Browser Fingerprints
Anti-fraud systems are shifting from static device and browser fingerprinting toward continuous behavioral analysis powered by machine learning. The article explains why matching User-Agent strings with Canvas or font rendering is no longer sufficient, as bot developers can easily synchronize these static signals. Modern defenses now record dozens of micro-events during a session, including keystroke timing, mouse trajectories, scroll speed, and focus changes, to build a dynamic Trust Score. These models are trained on large clusters of real-user behavior and flag sessions whose patterns fall outside legitimate clusters even when fingerprints appear realistic. The text details dwell time, flight time, error-correction patterns, natural hand tremor, and acceleration curves governed by Fitts’s law as key biometric markers. It also covers browser-level signals such as Event.isTrusted, CDP artifacts, and navigator.webdriver flags that reveal automation frameworks. The discussion extends to mobile sensors and concludes that perfectly error-free, mathematically smooth input is itself a strong indicator of synthetic activity.