Google DeepMind and Singapore Built a Scam Detector That Runs Entirely on Your Phone, No Cloud Required

Google DeepMind and Singapore's Government Technology Agency have built an AI model that spots scam conversations on a smartphone and never sends the messages anywhere. The system, announced on October 14 at Singapore International Cyber Week, was developed under the National AI Partnership between Google and the Singapore government and is built on Gemma, Google's lightweight open model, fine-tuned on local scam material.

The architecture is a two-stage pipeline designed around a phone's battery budget. A low-power classifier first screens incoming messages for anything suspicious. When something trips that first filter, the fine-tuned Gemma model examines a larger slice of the surrounding conversation to confirm the threat or discard a false alarm. If manipulation is confirmed, the user gets a real-time warning suggesting they pause before sending money or sharing sensitive information.

The privacy claim is structural rather than contractual: because inference happens on the device, neither Google nor the Singapore government can access conversations through the deployment. Applications that integrate the model must obtain user consent before it can read anything. Training happened inside a Google Cloud environment managed by GovTech, using anonymized scam reports and intelligence feeds with no personally identifiable information, and the model was stress-tested against synthetic dialogues and local corpora spanning different scam categories and impersonation tactics.

The local focus is deliberate. Singapore's scam problem is severe and specific: scams account for more than half of the country's reported crimes and have cost more than S$4 billion since 2019, according to figures cited in the announcement, with social engineering — where scammers spend days building trust before asking for money — responsible for up to 80 percent of losses. Police statistics for the first half of 2026 recorded 16,821 cases and S$410.6 million in losses, down 14.4 percent and 17.9 percent year on year, but the fraud that remains is increasingly the kind that generic models miss: impersonation of public institutions, banks and local figures, plus regionally specific schemes. All capability and loss figures come from the DeepMind blog and official Singapore statistics and have not been independently audited.

What has not been disclosed is just as notable: no rollout date, no participating messaging apps, and no accuracy or false-positive figures. The model is intended for Android devices and will be introduced gradually through apps developed with the Singapore government. Google also released Be Scam Ready 2.0, a shortened version of its scam-awareness game, as part of the same announcement.

The significance goes beyond one market. End-to-end encrypted platforms have long faced a choice between scanning messages on servers — which breaks the privacy promise — and doing nothing. An on-device detector fine-tuned on local scam patterns offers a third path, and DeepMind says platforms and OS vendors can integrate the lightweight models directly. It is also exploring similar deployments in other countries, which would turn a Singapore pilot into a template.

The catch is that on-device processing solves the privacy half of the problem, not the whole of it. Local inference says nothing about how often the model cries wolf, how quickly it adapts when scam scripts change, or who is accountable when it misses a transfer-draining conversation. Those numbers are exactly what has not been published yet.