- Google DeepMind and GovTech Singapore fine-tuned a Gemma model to spot scam conversations on the phone, without sending chats to a server. It is not yet deployed in a named app.
- The design matters because many scams build trust through conversation. DeepMind puts their share of losses at up to 80%.
- The post gives no accuracy figures or launch dates. Ask any fraud vendor where detection runs, what leaves the device and how errors are measured.
The scam is a conversation, not a link
Most security tools were built to catch a bad file or a bad link. Many scams now have neither. They are a patient chat with someone who sounds like a bank, an official or a recruiter. The request for money comes last.
Google DeepMind published this work with GovTech, Singapore's technology agency. It was presented at Singapore International Cyber Week 2026. The post says scam tactics have moved from simple phishing to social engineering, where attackers win trust through convincing conversations before asking for money. By DeepMind's estimate, losses tied to this kind of scam reach as high as 80% of the total.
These figures come from DeepMind's post. The post does not say who compiled them.
What the two organisations built
DeepMind and GovTech fine-tuned Gemma, Google's lightweight model, on local scam conversations. The examples ranged from fake banks and public bodies to impersonated local figures and trending regional schemes.
The focus on local data is deliberate. DeepMind says generic models often struggle with local deception. A scam that imitates a Singapore institution is a different problem from a generic phishing email.
The model is designed to run on the phone. When it sees manipulative patterns, it will show a warning on the device. The warning advises the user to pause before sharing sensitive information or sending money. The post does not name any application where this is live yet.
How it works on a battery
Running a large model over every chat would drain a phone. DeepMind says battery efficiency is a critical concern. So it uses two stages.
Stage 1 is a small classifier. It screens incoming messages with minimal power and flags possible threats. Stage 2 is the fine-tuned Gemma model. It reads a larger part of the chat. Then it confirms the threat or discards the false alarm.
Think of a cheap filter in front of an expensive judge. The costly step runs only when the cheap one flags something. That keeps the model practical on a handset.
Privacy by location, as DeepMind describes it
Traditional detection scans messages on a server in the cloud. This design moves the analysis to the phone. DeepMind says the model runs entirely on the device. So, it says, neither the Singapore Government nor Google can access users' conversations through it. The post offers no independent audit of that claim.
Think of a smoke alarm in the room versus a monitor at the fire station. The alarm sees what the room sees. It tells only the people inside. The post presents this as a model for messaging platforms that must protect users and keep end-to-end encryption.
Access depends on consent. The model can read on-device conversations only with the user's consent. That follows each application's terms of use.
DeepMind also lists governance steps. Fine-tuning ran inside GovTech's own managed Google Cloud environment. Training used anonymised datasets from scam reports and intelligence feeds. It excluded private or personally identifiable information. Testing used synthetic dialogues and local corpora.
What the post does not say
This is a company announcement, and it leaves gaps. It gives no accuracy, false-alarm or missed-scam rates. It names no apps, languages or launch dates. It says only that the rollout will be carefully phased.
DeepMind says it has "proven" local, real-time detection. Without published results, leaders should treat that as a claim to test. The post also does not say how often the model will be updated as scammers change tactics.
What leaders should ask
The idea carries beyond Singapore. If the attack is a conversation, the check belongs where the conversation happens. That matters for banks, telecoms and any firm whose staff or customers are approached through chat.
Five questions are worth putting to your fraud teams and your vendors.
Where does our detection run? Does message content leave the device to be checked? What are the measured false-alarm and missed-scam rates, and who measured them? How does the model learn new local scam patterns, and how fast? What does the user see at the moment of risk, and can they act on it?
The Singapore project is one early example, not a trend. Its lesson is narrow but useful. Scammers build trust over many messages. A defence that judges one message at a time sees too little.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Google DeepMind.
