Google DeepMind and Singapore Release Gemma-Based Scam Detector as Fraud Losses Top S$4 Billion

Fraud makes up more than half of all reported crime in Singapore, and cumulative losses since 2019 have exceeded S$4 billion. Google DeepMind and the Government Technology Agency of Singapore (GovTech) presented their answer at Singapore International Cyber Week 2026: a model that detects scam conversations and runs entirely on a smartphone. It is built on a lightweight Gemma fine-tuned on local scam scenarios. The project grew out of DeepMind's national partnership with the Singapore government.

Why server-side filters hit a wall

Scams have changed. Simple phishing has given way to social engineering: the victim is worked over with convincing messages for a long time, and only then asked for money. According to the project's authors, such scenarios account for up to 80% of all losses. They are hard to catch by link or email template, because a conversation may contain no malicious link at all.

The second problem is encryption. Classic protection scans messages on the server, but many messengers use end-to-end encryption, so the platform simply cannot see the contents of chats. The third is local context. General-purpose models are worse at recognizing fakes that impersonate Singaporean government bodies, banks and well-known local figures, as well as regional schemes that appear and vanish quickly.

The team's solution is to move the analysis onto the device. The conversation stays with the user, and the warning appears before the person sends money or login credentials.

How the two-stage pipeline works

Running a complex classifier on an ordinary phone means fighting for battery life. So the system is split into two stages. First, a lightweight, low-power classifier scans incoming messages; its job is to spot a potential threat. If it raises a suspicion, the second stage kicks in: the fine-tuned Gemma evaluates a larger fragment of the conversation and either confirms the threat or clears it. This setup also helps with false positives: an everyday chat in which someone asks to borrow money should not look like an attack.

When a threat is confirmed, the model shows a warning right on the screen, advising the user to stop and not share sensitive information or funds. For training, the team used dialogues realistic in structure: imitations of government agencies, banks, local public figures and current regional schemes.

Key project parameters:

• Base: Gemma, a lightweight Google DeepMind model, fine-tuned on local fraud scenarios.
• Where it runs: on the smartphone; analyzing conversations does not require sending data to the cloud.
• Stage 1: a lightweight, low-power classifier for incoming messages.
• Stage 2: contextual evaluation of a larger conversation fragment by the fine-tuned Gemma.
• Training environment: a managed GovTech environment in GCP with isolated data.
• Data: anonymized datasets drawn from fraud complaints and intelligence feeds, with no personal data of citizens.
• Validation: synthetic dialogues and local corpora covering different categories of schemes and impersonations.
• Not disclosed: model size, accuracy, false-positive rate, list of supported devices.

Data governance and limitations

The authors separately stress the discipline applied during development. Fine-tuning took place in a "sovereign sandbox", a GovTech environment that the agency operates itself. Any private and personally identifiable information was excluded from the training set. Robustness to new techniques was tested with synthetic dialogues that imitate shifting identity-spoofing tactics.

Mark Chen, GovTech's director for trust and safety, describes the goal this way: catch targeted local scam attempts in real time without violating the privacy of conversations.

Who can use this, and what is missing

The project is designed as a template for messengers and operating system vendors: they can embed similar lightweight models and protect users locally without breaking end-to-end encryption. For banks and regulators in other countries, it is a working blueprint: a national model trained on local data, plus client-side analysis.

But the publication leaves open questions, and without answers to them real-world effectiveness cannot be assessed. There are no figures for detection accuracy and recall, no data on false positives in live conversations, and no battery drain measured in hours. It is not described how exactly the tool will be built into specific apps, or who will update the model when scammers change their schemes. For now, this is a demonstration of an approach, not a finished product ready for mass deployment. What to watch: which platform is the first to integrate the model and publish independent measurements.