GovTech Singapore launches AI-powered mobile app to help citizens proactively fight scams

Imagine receiving a string of messages, first asking how you're doing, later proposing you an investment opportunity, then to pay a registration fee to unlock the deal. 

Now with the AntiScam Pango mobile app, you will receive a pop-up notification on your screen alerting you of a potential scam. 

You can then report the messages directly through the app, or tap “mark as safe” if it was a false alert. 

At GovTech Singapore's STACK conference on November 4, GovTech announced the beta launch of AntiScam Pango mobile app, which for now is only available in Google Play Store for Android users. 

The app uses artificial intelligence (AI) to analyse notifications from incoming messages, and the analysis is done entirely on the user’s devices. 

According to the official release, GovTech and other parties involved in building the app and AI model cannot access the user's personal information or private messages through the app.  

The product team at GovTech has trained a small AI model on more than 100,000 synthetic messages and scam data collected over the years in its anti-scams work with enforcement agencies.  

GovTech is also working with Google DeepMind to further train the model. 

Speaking to media, GovTech’s Assistant Director for Engineering Management, Chong Chee Siang, says that the app currently works only on Android as it's the only system that lets its apps read notifications from other apps, including WhatsApp, Telegram and SMS. 

While GovTech's product team is exploring to bring the app to other systems, the team says that it will continue to prioritise user's privacy by adopting this on-device approach. 

Protective yet private 

GovTech's product manager, Kelly Ng, says that like the Pangolin, a native animal to Singapore, the "Pango" app is meant to protect Singaporeans against scams, while keeping their messages private. 

Asked how the new app differs from the existing ScamShield app, the product team says ScamShield currently covers phone calls and SMS, while the new app adds early warnings for WhatsApp, Telegram, and SMS messages.  

The app also makes reporting easier, as it automatically compiles the suspicious messages, the sender, the messaging app and the time the messages arrived.  

Users can check before submitting the report. 

According to the product team, the app only analyses the last 10 messages across each messaging app for scam signals, such as urgent requests for money and promises of high returns. 

The app does not analyse the user's replies to the suspected scammer. The sender's messages also only stay on the user's phone unless the user chooses to report them, says Chong.  

"We actually don't want to come up with an app that can do all of this (referring to scanning and accessing the full conversation between user and sender)," says Chong, explaining that the team has to balance protecting users and invading their privacy. 

According to Chong, the team gathered feedback from more than 30 users across GovTech's staff and members of the public (through the Smart Nation Ambassadors) to improve how the app alerts users. 

Some older testers said the pop-up notification was unclear.  

When these users put their phone down and came back later, the alert piled up among other notifications and they did not realise it was a scam warning.  

This led the product team to add a full-screen red warning that appears the next time the user opens the screen. 

This feature works only if the user allows the display overlay permission. 

Why a small AI model was chosen 

GovTech's product team says that the small AI model used for the current app was built in-house, and is working with Google DeepMind to improve the training process. 

A small AI model allows users to keep everything on their phones, while also protecting them against potential scams, the team notes.

GovTech's Director of Trust and Safety, Mark Chen, observes that some users were already pasting suspicious messages into commercial AI models to check for scams. 

While these large, cloud-based models tend to spot scams more accurately, Chong notes that the user's messages are not private. 

“We’re striving to be as close as possible to those accuracy benchmarks, but with a model small enough to run entirely on your phone,” Chen says.  

The AI model on a user’s phone also does not learn on its own, says Chong.  

Every few days, the app sends the aggregate figures around how many messages it received and how many users marked as safe or suspicious.  

The team uses these to check whether the model is flagging too much. If it is, the team fine-tunes the model themselves. 

Hackathon origins and next steps 

The idea began at an internal hackathon, with the team comprising two full-time engineers, one data scientist and one product manager. 

The team wanted a way to warn people about a scam while the conversation was still going on, without having them send their messages anywhere.  

With WhatsApp and Telegram platforms accounting for a large share of scams in the last six months, there are currently no existing tools that protect users against scams.  

As the team members were already working on GovTech's anti-scam products, they were familiar with the gaps in current solutions, says Ng. 

The hackathon provided the time and space for them to work on ideas that did not have dedicated manpower at that time, she says. 

As for the next steps, the team is focusing on further testing with users and honing the app, before considering integrating it into ScamShield to leverage the latter’s much larger user base of more than a million. 

The app still has limits. It works primarily in English and can struggle with slang.  

It also needs a phone with at least 6GB of Random Access Memory (RAM), which the team estimates covers 70 to 80 per cent of Android phones in Singapore. 

The team is inviting Android users to report its mistakes, and it wants to compress the model so that more phones can run it. 

There is also currently no timeline for an iPhone version, because Apple does not currently let apps read notifications from other apps.  

The team says it will not compromise on privacy to get there. “If it compromises the user data, then it’s a no-go for us."