Apple’s new Impersonation Risk Detection feature assesses suspicious behaviour on device and can prompt apps to slow or verify high-risk actions, but users must enable it and compatible apps remain limited.
Apple’s iOS 27 adds a new layer of protection aimed at one of the hardest scams to stop: impersonation and social engineering. According to Apple’s support documentation, the feature, called Impersonation Risk Detection, is designed to spot suspicious behaviour in real time when a user may be being manipulated into sending money, changing account details or approving another sensitive action. In practice, it is meant to catch situations in which a fraudster poses as a bank, public authority or trusted contact and pressures the victim into acting against their own interests.
The system is intended to complement, not replace, existing safeguards such as two-factor authentication. That matters because many modern scams do not involve a hacker bypassing security checks. Instead, they rely on persuading the user to authorise the transaction themselves. As MacObserver reported, supported apps can ask iOS 27 for a risk assessment before allowing a high-risk action, such as a payment or a change to account information. The app then decides how to respond, which may include asking for extra verification or delaying the action.
Apple says the assessment is based on signals from the device and the Apple Account, with the system considering behavioural patterns, timing, context and basic sensor data. Tom’s Guide reported that the analysis happens on device, and that Apple does not receive the underlying content from Photos, Messages or Mail. The app only gets the resulting risk level, rather than the data used to produce it, which is consistent with Apple’s wider privacy approach.
The feature is not switched on by default, and it only works in apps that have added support for it. Apple’s support page says users can enable it in Settings under Privacy & Security, then choose the option to share with app developers. Beebom noted that activation may take up to 24 hours to take effect. Apple also warns that a request to turn the feature off could itself be part of a scam, a reminder that attackers often try to remove safeguards before making their move.
Once enabled, users can return to the same settings screen to see how the feature is being used. Apple says recent activity will show which apps have requested a risk assessment, while the reason for access explains which action triggered the request. That gives users a way to see whether the protection is being called when they send money, update credentials or carry out another sensitive task.
Apple has not yet published a full list of compatible apps, so it is not yet clear which banking, payment or messaging services have adopted the system. Even so, the feature represents a notable shift in mobile security: instead of waiting for a scam to be detected after the fact, iOS 27 is trying to intervene at the moment a user is about to act. That still does not make an iPhone immune to fraud, and Apple itself continues to advise users not to share passwords, verification codes or banking details with anyone who creates a sense of urgency.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
