iOS 27's New Feature Helps Guard Against Scams

Protect Yourself with Impersonation Risk Detection

Apple has rolled out an innovative feature in iOS 27 and iPadOS 27 designed to aid users in identifying social engineering scams: Impersonation Risk Detection. However, it's important to note that this feature is not automatically activated, so users must opt-in to benefit from its protective capabilities.

Understanding the Feature

Social engineering scams are particularly effective because they can bypass traditional security measures, persuading users to take actions that could compromise their personal information. The Impersonation Risk Detection works by analyzing the context around actions you take within supported apps on your device, such as making payments or altering passwords.

When you initiate a sensitive action, the system evaluates your account and device data for potential scam indicators. Based on its assessment, the app will receive a risk level classified as follows:

• Unknown: No suspicious activity detected, but the action isn't confirmed as secure.
• Medium: Some signs of potential scam activity noted.
• High: Significant suspicious activity identified.

Based on the risk level assigned, the app may prompt you to confirm your identity, display a warning, or pause the action until verification is completed. The decision-making lies with the app, not Apple.

Data Privacy Commitment

While Apple evaluates specific interaction data to determine risk levels, this data does not leave your device. The company avoids analyzing content within apps like Mail and Messages. Instead, when an app requests a risk assessment, Apple learns which type of action was attempted but not the underlying personal information.

Impersonation Risk Detection is deliberately disabled by default. This caution stems from the fact that participating apps require a certain degree of access to monitor user actions and behaviors.

How to Activate Impersonation Risk Detection

To turn on Impersonation Risk Detection on your iPhone or iPad, navigate to your Settings and select Privacy & Security. Scroll down and tap on the Impersonation Risk Detection option. Here, activate the toggle for Share with App Developers. Keep in mind that it may take up to 24 hours for the feature to fully activate.

You can also see a list of apps that utilize this feature on the same screen, allowing you to monitor their activity. If you wish, you can revoke access for specific applications anytime.

Both native and third-party applications can participate in this detection system, although Apple hasn’t specified any particular apps that currently support it. Given the growing prevalence of social engineering scams, it is hoped that many developers will incorporate this functionality.