Google DeepMind and Singapore GovTech are building an on-device scam detector tuned on local conversations

Google DeepMind and Singapore’s GovTech are developing on-device scam detection using a locally tuned Gemma model. The practical distinction is a locally tuned model still in development, rather than proof that it is the protection already listed in Android’s settings. The collaboration was discussed at Singapore International Cyber Week on October 14, 2026. The sources describe development and phased deployment, rather than a demonstrated nationwide reduction in fraud.

What Google says changed

In its DeepMind blog post, Google says the collaboration with GovTech Singapore produced a fine-tuned version of its lightweight Gemma model for scam detection. The training data, according to Google, came from anonymised scam reports and intelligence feeds rather than citizen messages. The company says the model was exposed to local patterns, including impersonation of public institutions, banks, public figures, and region-specific schemes, because generic models can miss the cues that matter in a local context.

Google says conversation analysis can run on the device. That is the stated processing location for this collaboration, rather than a claim we have independently verified. It should not be treated as a guarantee about every messaging app or every Google scam-detection product.

How the system is supposed to work

Google describes a two-stage pipeline. First, a lightweight classifier screens inbound messages with minimal power use. Second, the fine-tuned Gemma model examines a larger snapshot of the conversation to confirm a threat or dismiss a false alarm. If the model detects manipulative patterns, it is designed to issue a real-time warning on the phone. Google also says the rollout inside applications will be phased, and that any deployment will require user consent under the app’s terms.

That design reveals the product trade-off. On-device protection can preserve privacy, but it must work within a smartphone’s battery and compute budget. Google says power efficiency is a major concern, which is why it splits detection between a lighter first pass and a heavier contextual pass. For mobile security teams and messaging platforms, that is the real engineering question: how much context can you inspect before the feature becomes too slow, too power-hungry, or too noisy to keep enabled.

Why Singapore matters here

Singapore’s government has been explicit about why it wants this kind of tool. In a speech at SICW 2026, Minister Josephine Teo said scams have become harder to stop because AI makes deception cheaper, more convincing, and easier to personalise. She argued that defenders need early detection across the scam chain, not just stronger checks at the final payment step. She also said GovTech is collaborating with Google DeepMind on real-time scam detection on devices, so that potential victims can be warned before financial or credential loss.

CNA’s reporting adds important operational context: the Singapore push sits alongside existing anti-scam systems that already work at scale, including GovTech and the Singapore Police Force’s SATIS system, which the minister said scans and assesses more than 600,000 websites a day and disrupts around 20,000 malicious sites a month. The new on-device model is not a replacement for that broader ecosystem. It is an additional layer aimed at the one place many scam chains now converge: the user’s phone.

The boundary readers should notice

The useful distinction is between a public product feature and a Singapore-specific collaboration. Google’s Android support documentation says Scam Detection is available in Singapore on select Android devices, runs in a secure isolated environment, and keeps message content private unless the user chooses to share it. That is evidence of a broader Google feature already exposed in some markets and devices. It is not, by itself, proof that the GovTech-DeepMind model is already broadly shipped, widely installed, or performing as intended.

That distinction matters for anyone making a deployment decision. A platform team deciding whether to integrate similar detection should not confuse regional availability with mature rollout. The evidence here supports a more cautious conclusion: the vendor has described an architecture and the government has identified a use case, but Google has not published independent benchmarks, adoption numbers, or real-world reduction in fraud losses.

There is also a product limitation in Google’s own help text: Scam Detection may not catch every scam. That is not a footnote. It is the operational boundary. On-device AI can narrow the gap between message receipt and user awareness, but it cannot eliminate social engineering, especially when the attacker moves quickly across channels or relies on tactics the model has not seen.

Before treating the GovTech collaboration as an available protection, look for a named supported application and its device and consent requirements; a general Android availability list does not establish that this particular model has shipped.