Google DeepMind and Singapore's GovTech are building fraud detection that runs directly on the phone
Without messages ever leaving the device: Google DeepMind and Singapore's GovTech have announced a scam-detection model built on Gemma, with two-stage analysis of manipulative conversations. But the model is announced, not launched — neither a release date nor accuracy figures are available.
Google DeepMind and the Government Technology Agency of Singapore (GovTech) announced on 14 October 2026 a scam-detection model designed to warn users about manipulative conversations — without private messages being sent to the cloud. The announcement came during Singapore International Cyber Week and is part of Google's national AI partnership with Singapore. The backdrop is serious: Singapore residents have lost more than S$4 billion to scams since 2019, including S$410.6 million in the first six months of 2026 alone, according to The Straits Times.
How the system works
The model is built on Google's lightweight, open Gemma model, fine-tuned on local scam conversations. The training material ranges, according to the announcement as reported by Unite.AI, from impersonations of public institutions, banks and local well-known figures to current regional scam schemes.
Detection happens in two stages. In stage one, a lightweight and energy-efficient classifier screens incoming messages with minimal power consumption, focused on catching potential threats. In stage two, the fine-tuned Gemma model makes a contextual evaluation of a larger portion of the conversation to confirm a threat or discard a false alarm. The setup is a classic trade-off: the cheap classifier decides when the expensive model is switched on at all, so the phone does not expend heavy resources on every single message.
Why on-device running matters
The central promise is that no message content leaves the phone. In a blog post dated 14 October, Google DeepMind's JJ Geewax and Miguel de Andrés write, as quoted by The Straits Times: "Once deployed, the model will only be able to access conversations on-device with user consent." They add that neither Singapore's government nor Google will be able to read users' conversations through the model's rollout.
For Singapore's authorities, this is a deliberate point. "Fighting scams should not mean sacrificing privacy. Together with Google DeepMind, we are bringing advanced AI protection directly onto citizens' devices," said Mark Chen, director of trust and safety at GovTech, to The Straits Times.
The development reportedly took place under three principles, as reported by Unite.AI. "Sovereign Sandbox" means the fine-tuning was carried out in GovTech's own managed Google Cloud environment, keeping training data segregated. "No Citizen Data" means training strictly excluded private or personally identifiable information, instead using anonymised datasets from scam reports and intelligence material. The third principle, "Stress-Testing," is said to cover adversarial testing of the model.
Why Singapore
Singapore's scam losses are large and still growing: more than S$4 billion since 2019, and S$410.6 million in the first half of 2026 alone, according to figures The Straits Times cites. The announcement, as summarised by Unite.AI, also claims that scams account for a large share of losses and over half of recorded crimes in the country — but those figures are the company's own claims and have not been verified against official statistics.
The model is not the first countermeasure. According to Cryptobriefing, Singapore already operates SATIS, which works for the police and disrupts around 20,000 malicious web pages per month, and rMSE, which scans more than 600,000 web pages daily. What is new is that the defence moves from infrastructure and web pages to the conversation itself on the user's phone — where many scams culminate today. The same day, Google also announced that Singapore will get access to the company's advanced AI tools for cybersecurity, intended to help cyber defenders find, verify and fix vulnerabilities in minutes.
According to Cryptobriefing, the announcement was made by Minister for Digital Development Josephine Teo at Singapore International Cyber Week, as part of the effort against AI-driven scams. Unite.AI describes Google DeepMind's blog post as the core announcement; the exact sequence between the minister's presentation and the blog post is unclear in the sources.
What we do not know
The most important caveat: the model is announced, not deployed. Neither Google DeepMind nor GovTech has given a launch date, and The Straits Times reports that it is unknown whether the model will become a standard Android feature. Nor are accuracy or false-positive figures available — there are no published measured figures for how well the system actually recognises scams, or how often it flags entirely harmless conversations.
Distribution is a separate bottleneck. Cryptobriefing points out that a detection model only helps if it is built into the apps people actually use, which usually requires cooperation with messaging platforms and device makers. No such agreements are confirmed.
The source base is also worth noting: the descriptions of mechanics and governance come from Google's own announcement, relayed through secondary sources such as Unite.AI, The Straits Times and Cryptobriefing. No primary source is publicly available in this record, and Unite.AI itself states that the article was produced by an AI-driven research agent and reviewed by its editorial team.
What it will take for this to become protection
The promise of fully locally running scam detection on ordinary smartphones is technically demanding: a small model must be accurate enough to catch manipulative patterns and small enough to run on mid-range hardware without draining the battery. The two-stage pipeline is one answer to that trade-off, but how well it works in practice remains to be seen. There is also the consent mechanism: the model is only to read conversations with the user's consent, and how that consent is designed and experienced in practice is still unknown.
Until Google provides a date, a distribution model and measured figures, the right conclusion is the one the sources themselves point toward: an ambitious and privacy-friendly design exists — but for now it is an announcement, not a protection you can switch on.