Is this WhatsApp message a scam? How to check fast

Does Google's new AI scam detection work on WhatsApp?

No. Google's new AI scam protection works in Google Messages, Android's texting app, not inside WhatsApp. On 14 October 2026, Google announced an opt-in "enhanced protection" setting for Google Messages. It adds cloud-based Gemini analysis on top of the on-device scam detection that already runs in the background. The idea is to catch slow-burn scams, the kind that start with a friendly "wrong number" chat and only turn into a request for your name, your money or a code after a few days. Google says the messages are processed in an encrypted, private space it can't access itself. The setting rolls out over the coming weeks, starting with the Pixel 10 series and Samsung's Galaxy S26, Z Fold 8 and Z Flip 8.

There's a second piece too. On-device AI now checks live web signals about unfamiliar links before you tap them. That matters because scammers keep registering brand-new websites that security blocklists haven't caught up with yet. The same announcement brought "likely scam" alerts to phones from more manufacturers, plus a shield that stops malicious apps from quietly forwarding your calls. It's a solid set of upgrades. They just protect a different inbox from the one most small business owners actually live in.

If you run a business in Israel, Spain, Brazil or most of Europe, your fake invoices, "your parcel is held" texts and "Hi Mum, I lost my phone" messages almost certainly turn up on WhatsApp, not as SMS. Google's new tools can't see that chat at all. So you need your own scam check for WhatsApp, and the good news is it only takes a minute.

What does WhatsApp already do to protect you from scams?

WhatsApp has built-in scam protections, but they mostly flag suspicious contexts rather than read your messages for scam content. Because chats are end-to-end encrypted, WhatsApp can't scan what a stranger writes to you the way a texting app's filter might. Instead, it gives you more context about who's on the other end. When someone outside your contacts adds you to a group, you now see a safety overview before you're in. It shows who invited you, when the group was created and how many members it has, and offers buttons to leave straight away or peek at the chat first. Notifications stay silent until you decide to stay.

There are a few more tools worth switching on. You can silence calls from unknown numbers in privacy settings, which cuts out a lot of fake "bank security team" calls. WhatsApp also warns you when you start sharing your screen with someone who isn't in your contacts, because scammers use screen sharing to watch you type banking details and one-time codes. Turn on two-step verification as well. It adds a PIN on top of the SMS code, so a stolen code alone isn't enough to hijack your account.

WhatsApp also bans scam accounts in huge numbers. In the first half of 2025 alone, it shut down more than 6.8 million accounts linked to criminal scam centres. Here's the uncomfortable part, though: a ban only happens after the account has already been reported, and a fresh number costs a scammer next to nothing. WhatsApp's own advice boils down to three words: pause, question, verify. It's good advice, but the verifying is left to you.

How do you spot a WhatsApp scam before you reply?

You spot a WhatsApp scam by checking the request, not the writing. Almost every scam ends with you doing one of four things: sending money, sharing a code, tapping a link or moving the chat somewhere else. Here's my unpopular opinion: spelling mistakes are a useless test now. Scammers use AI to write clean, polite, perfectly punctuated messages, and some scam rings have been caught doing exactly that. A message that reads beautifully and asks you to pay a new account today is far more dangerous than a clumsy one. So skip the grammar check and ask yourself what this person actually wants you to do, and how fast they want you to do it.

For business owners, the riskiest scam is the fake invoice. It usually looks like it's from a supplier you really use, with the right logo and roughly the right amount, plus a short note: "We've changed banks, please use the new details below." Sometimes it's an exact copy of a bill you've already paid, sent again in the hope you'll pay twice. If you deal with a lot of PDFs, it's worth learning how to catch duplicate invoices before they're paid, because nobody remembers every invoice number they've ever paid.

The personal scams follow the same script with a different face. The "Hi Mum" message comes from an unknown number claiming to be your child with a broken phone, and two messages later there's an urgent bill to pay. The courier text says your parcel is stuck and asks for a small "redelivery fee" through a link. The job offer pays you to like videos, then asks for a "deposit". Different stories, same red flags: an unfamiliar sender, urgency, money or codes, and a link to a site you didn't go looking for.

How can an AI assistant in WhatsApp check a suspicious message?

An AI assistant in WhatsApp can give you a quick second opinion: you forward the suspicious message or a screenshot, and it reads it, points out the red flags and searches the web for the sender, the link or the company. With Agent Sonic, that's just another chat. Long-press the message, forward it to Sonic and add a line: "Is this courier text legit? Search the tracking site." Or: "This says it's from my bank. Does that link match their real website?" Sonic reads the text, checks the domain against what it finds online and replies in plain English. You don't open a browser, copy a link or tap anything risky yourself.

Screenshots work too, which is handy when the scam turns up on Instagram, email or text before it lands in WhatsApp. If you've never tried it, here's how forwarding a screenshot to an AI works in practice. For invoices, send the PDF itself: "Check this invoice from Cohen Supplies. Do the bank details match the ones I saved last month?" Sonic keeps a memory, so you can tell it once, "Remember Cohen Supplies' real IBAN is the one on this invoice", and it'll compare future bills against it. It can also flag an invoice you've already been sent.

A fair question before you forward anything: what happens to that document afterwards? If your invoices carry client names and account numbers, read up on what to check before sending documents to an AI. The same habit works for quick facts as well: "Is +44 7700 900123 linked to any scam reports?" or "Does this delivery company actually exist in Portugal?" If you'd rather not juggle tabs, you can ask questions and get answers right in WhatsApp and keep the whole check inside the chat you're already using.

Can you trust an AI scam check, and what should you do next?

Treat an AI scam check as a second opinion, not a guarantee. An assistant can tell you a link points to a domain registered last week, or that a "supplier" sounds nothing like your real one. It can't see who's actually holding the phone that sent the message. A real supplier's WhatsApp can be hacked, and a brand-new scam site may not show up in any search yet. Google's own new feature has the same weakness in reverse: false alarms on real recruiters, couriers or small businesses you've never heard of. So if the AI says "looks fine", that's not permission to pay. It's one more piece of evidence.

The step that actually protects you is verifying through another channel. Call your supplier on the number already in your contacts, not the one in the message. Ring your daughter's old number, or ask a question only she'd know. Open the courier's app yourself instead of tapping the link. Never forward a verification code to anyone, ever, no matter how friendly they sound. One rule has saved more businesses than any filter: bank details never change by message alone. If a new account number turns up in a chat, it waits until you've heard it from a voice you recognise.

And if you've already paid or shared a code? Move fast. Call your bank straight away and ask them to stop or recall the transfer. Then block and report the sender in WhatsApp, and if they got into your account, set up two-step verification as soon as you're back in. Warn the people in your contacts, because hijacked accounts are used to message friends next. To make the second-opinion habit stick, keep an assistant one forward away. Get set up with Agent Sonic here: leave your details and you'll get Sonic's number and a quick onboarding.

Frequently asked questions