Google and Singapore have built a private smartphone scam detector that studies a conversation for signs of manipulation and warns the user before money or personal details change hands. The two partners showed the technology on Wednesday at Singapore International Cyber Week. It runs on a customised version of Google’s Gemma model and reads the flow of a chat rather than scanning for a single bad link or keyword.

What the system does

The tool watches for fraud that builds over many messages. Instead of flagging one suspicious line, it looks at the wider exchange and asks whether someone is working to gain trust before asking for payment, passwords or other confidential information. When it spots that pattern, it puts a warning on the handset and tells the person to slow down. The alert is meant to land before the user acts on a scammer’s instructions.

Google DeepMind said the model was adapted using examples of scams that impersonate banks, public bodies and well-known local figures. Training also covered regional fraud methods designed to make fake exchanges look believable to people in Singapore.

How the on-device scam detection works

The private smartphone scam detector runs in two stages to keep the load on a phone low. A lightweight classifier checks incoming messages first and uses little computing power. Messages that look risky then move to a closer check by the fine-tuned Gemma AI model, which reviews a broader slice of the conversation.

The key design choice is where the work happens. Analysis stays on the phone, so chats never need to be sent to the cloud for review. That matters for messaging services that use end-to-end encryption, which is built to stop anyone in the middle from reading what people write. Mark Chen, director of trust and safety at GovTech Singapore, said the collaboration set out to catch targeted local scams in real time while keeping private messages private.

Privacy built into the training

The partners say the privacy work extended to how the model was trained. Google DeepMind fine-tuned it inside a government-managed Google Cloud environment it calls a sovereign sandbox, where the training material stayed isolated. Private conversations and personally identifiable information were left out, the company said. Developers used anonymised data drawn from scam reports and intelligence feeds, then tested the model on synthetic conversations and local material across different scam types and shifting impersonation tricks.

Those points describe how the system was made and how it is meant to run. They are not an outside review of the finished product. The partners have not published false-positive rates, missed-scam figures, battery use or results across different phone models.

Why Singapore is pushing on this

The country has clear reasons to act. Google DeepMind said scams make up more than half of all reported crimes in Singapore, and total losses since 2019 have passed S$4 billion. The company estimated that social engineering scams account for as much as 80 per cent of those losses. Such schemes tend to depend on long contact, with the scammer building a relationship or posing as an authority before asking for money. Catching that intent across many messages is a harder technical problem than blocking a known fraud website or phone number.

What is still unknown

The announcement came with separate Android security updates from Google, including an optional cloud-assisted check in Google Messages that runs in a protected computing setup. The Singapore work takes the opposite route and keeps the analysis on the handset. The difference matters because each approach handles private communications in a different way, and real-world privacy will also depend on how each app builds in the technology.

Several basic details remain open. The partners have not named a public release date, listed supported messaging apps, or confirmed the minimum hardware a phone would need. They have also not said which manufacturers are taking part, or whether the tool will later support more languages and markets. For now, the technology is described as something messaging platforms and operating system developers could add, not an app ready to download.