Radar / Ideas / ScamShield: the on-device scam gate…

ScamShield: the on-device scam gate banks embed to stop APP fraud before money moves

daily ideaambitiousJEV confidence 0.52JEV monetization 0.642026-10-14

OutcomeCut authorized-push-payment scam losses for a bank by intercepting the social-engineering conversation on the customer's own phone — with a regulator-ready audit trail for every decision.

The problem

The scam happens in WhatsApp; the money leaves in the bank app — and the two never meet. Indians lost Rs 22,495 crore to cyber fraud in 2025, Singapore has lost over S$4B since 2019, and Brazil's PIX fraud hit R$6.5B in 2025. Bank fraud tools (BioCatch, Featurespace) score transactions and sessions server-side but are blind to the encrypted chat where the victim is being manipulated. Since Oct 2024, UK banks must reimburse APP-fraud victims up to GBP 85,000 per claim — so the loss now sits on the bank's P&L, with no tool that can see the scam as it unfolds.

The idea

A white-label Android SDK that banks and telecom operators embed in their own apps. It runs a two-stage on-device pipeline: a lightweight classifier screens message text arriving via the phone's notification channel (with explicit user consent), and a small on-device reasoning model judges conversation context across messages — investment-scam grooming, digital-arrest threats, fake KYC calls. Every detection becomes a calibrated typed judgment (approve / warn / block-and-escalate) with a probability the bank's fraud team can audit, plus a human-readable reason surfaced to the customer before they confirm a transfer. No chat content ever leaves the device: the bank gets the verdict and the audit trail, not the messages.

Why now

Three things collided this month: DeepMind x GovTech Singapore announced the first on-device scam-detection model for encrypted chats (Oct 14), proving the two-stage pipeline works alongside end-to-end encryption; Liquid AI shipped an open-weight 24B-agent model built for on-device tool use (Oct 13), making the judge stage cheap enough to run on a phone; and WhatsApp itself shipped an on-device scam alert in beta (Aug 2026), validating the approach while leaving it platform-bound, opt-in, and unavailable to any bank's own app.

What it combines

Three radar capabilities: (1) the GovTech x DeepMind two-stage on-device chat-classification pipeline (entry google-deepmind-x-govtech-singapore-on-device-scam-detection-ai-for-encrypted-chats) — the architecture; (2) small on-device reasoning models like Liquid LFM2.5-24B-A2B (entry liquid-ai-lfm2-5-24b-a2b-open-weight-24b-agent-model-for-on-device-agents) — the cheap on-device judge; (3) Jev-style calibrated typed decisions (entry autotrust-jev-35b) — turning raw detection into approve/warn/escalate verdicts a fraud team can defend to a regulator. No single one is a deployable bank product; together they are an embeddable, privacy-preserving, auditable fraud gate.

MVP

Weekend scope: Android-only SDK with (1) a distilled on-device text classifier trained on public scam-message corpora for two archetypes — investment-scam grooming and digital-arrest threats — reading message text via the notification-listener permission with explicit user opt-in; (2) a typed approve/warn/escalate gate with calibrated thresholds; (3) a demo banking app showing the warning interstitial before a mock transfer. Deliberately skip: iOS (Apple's permission model does not allow it), the on-device LLM judge stage (ship the classifier first, add reasoning once precision baselines exist), and any server-side component beyond a verdict-logging endpoint.

How it makes money

Budget owner: the bank's head of fraud management / VP fraud — e.g. UOB's advertised VP, Acquiring & Application Fraud Management role, a real team with vendor budget. Pricing anchor: SEON Fraud Fighters, a fraud-prevention API with public pricing at $699/month per 1,000 API calls — a per-device or per-active-user SDK tier prices above that for bank-grade custom contracts. Willingness to pay: replacement budget, not new budget — Visa paid $946M for Featurespace's transaction-only fraud AI (on GBP 63.4M revenue) and is reportedly paying $2.4B for BioCatch; banks already spend millions on fraud tools that cannot see the scam itself. The UK PSR's mandatory GBP 85,000 APP-fraud reimbursement turned prevention from a cost center into avoided P&L loss.

The moat

Data and architecture, not execution. The largest incumbents (Visa/Featurespace, BioCatch) are server-side scorers: their products, sales motion, and model pipelines all assume cloud data. Shipping an on-device SDK inside a third party's banking app requires a different architecture (tiny on-device models, OS permission flows, privacy-preserving evaluation), a different buyer conversation (privacy and compliance, not data science), and — critically — training data they do not have: real anonymized scam conversations are held by banks, telcos, and police (the GovTech model was trained on anonymized local scam data), not by payment networks. An incumbent cannot copy this in a quarter without rebuilding its product and acquiring a data asset it does not own.

Distribution

B2B2C: sell to bank fraud-prevention teams (VP Fraud Management / CISO) as an SDK embedded in the existing banking app — no new app to distribute. Wedge: markets where banks already carry the loss (UK under PSR reimbursement rules) and high-fraud mobile-first markets (India UPI, Brazil PIX, Singapore). Land via one regional bank's Android cohort, expand to telecom operators' apps for the same users.

Why it wins

Existing fraud tools score what the bank can already see: transactions, login behavior, device signals. The scam itself is invisible to all of them. The only on-device chat classification in production is WhatsApp's own alert, which banks cannot ship, is opt-in, and only covers non-contact messages. This is the only fraud signal from inside encrypted chat, packaged as a bank-owned SDK with an audit trail.

Risks

Biggest risk: precision on real conversations — false warnings erode trust and banks will not ship a nag screen. De-risk by shipping in silent-logging mode first with one partner bank's test cohort, measuring precision and recall against their confirmed APP-fraud cases before any user-facing warning goes live; keep the classifier conservative (high-precision, warn-only) until the on-device judge stage earns a block action.

Build it with

Google DeepMind x GovTech Singapore: on-device scam detection AI for encrypted chatsThe two-stage on-device chat-classification pipeline proven to work alongside end-to-end encryption — the core architecture to replicate.
Liquid AI LFM2.5-24B-A2B: open-weight 24B agent model for on-device agentsOpen-weight agent model class that makes the conversational judge stage cheap enough to run on a phone.
autotrust JEV-35B: 35B-A3B open decision model with calibrated probabilitiesCalibrated typed decision model pattern for turning raw detection into approve/warn/escalate verdicts a fraud team can defend to a regulator.

Repo to start from

scamshield-sdk — an Android SDK with the two-stage on-device scam classifier, the typed approve/warn/escalate decision gate, a demo banking app showing the warning interstitial, and an eval harness with anonymized scam corpora and precision/recall benchmarks.

Evidence

Get the week's best AI launches, plus 3 ideas worth building

One email every Saturday. Ranked by traction, not hype. Free.