iOS 27 Impersonation Risk Detection: How It Works
A scammer does not always need your password. Sometimes, they persuade you to make a payment yourself, reveal a verification code or change an account setting. That makes impersonation scams different from a straightforward attempt to break into your phone.
Impersonation Risk Detection is a security feature available from iOS 27 and iPadOS 27. This guide explains its setup and limitations using Apple's documentation. We have not independently tested its detection accuracy or confirmed a list of participating banking apps.
What Does Impersonation Risk Detection Do?
According to Apple's feature explanation, supported apps can request an assessment during sensitive actions. They receive a risk level and decide how to respond, potentially with a warning, delay or identity check.
Consider this illustrative scenario: a caller claims to represent your bank and tells you to transfer funds into a supposedly secure account. You are using the genuine banking app, but the instruction comes from someone untrustworthy. A legitimate app and a successful login do not make the requested payment legitimate.
This example explains the problem the feature addresses; it does not mean the system will detect this particular call or stop the transfer.
How to Enable It on iPhone
- Open Settings.
- Select Privacy & Security.
- Scroll to Impersonation Risk Detection.
- Enable Share with App Developers.
These steps appear in Apple's iPhone User Guide. If you cannot find the option, check your software version and current Apple support information. Avoid installing an unfamiliar app or configuration profile that claims to unlock this setting.
After enabling it, review the information shown on the settings page. You do not need to create a suspicious transaction to test protection. For an app you regularly use, consult its official help pages or support team about implementation.
What the Risk Levels Mean
| Level | Meaning |
|---|---|
| Unknown | No suspicious evidence detected; safety is not confirmed |
| Medium | Some suspicious signs detected |
| High | Significant suspicious signs detected |
These are assessment results supplied to an app, not necessarily labels you will see on screen. Never treat the absence of a warning as approval to follow an unfamiliar caller's instructions.
Which Apps Support It?
Developer adoption is required. Do not assume your bank, payment service or shopping app participates merely because your iPhone runs iOS 27. The warning's wording and the response can differ between implementations.
Our recommendation is to look for an explicit statement in the app's release notes or official support documentation. An App Store update alone is not confirmation. If support remains unclear, continue using your usual verification practices.
Privacy and App Activity
Apple says risk analysis happens on the device using signals such as interaction patterns, timing and context. It does not analyze the contents of Photos, Messages or Mail. Apps receive the risk level rather than those underlying signals; Apple learns the action type requested.
Settings includes Recent Activity and Reasons for Access, with individual app controls. Changes may take up to 24 hours. An App Store sign-in may be required to enable sharing.
Reviewing this activity can help you understand how a participating app uses the feature. A request for assessment is not, by itself, proof that your account was attacked. Check the associated action before drawing conclusions.
What to Do If a Warning Appears
Pause the action and read the message. If someone is guiding you by phone or chat, stop following their instructions and contact the organization independently using a trusted channel.
For example, use the number printed on your bank card rather than one supplied in the suspicious message. Do not share passwords or one-time codes to convince a caller that you are the account owner.
Apple's social engineering guidance covers suspicious messages and fake support calls. If you have already shared credentials or sent money, contact the relevant service promptly and follow its account-recovery or fraud-reporting procedure.
Keep Other Security Measures Enabled
This feature adds another opportunity to interrupt a scam. It does not replace a strong passcode, account authentication or careful handling of recovery information.
Build a simple habit: when a request involves urgency, secrecy or moving money, independently verify who is making it. A believable story deserves the same checks as a poorly written message.
For a separate example of Apple's approach to verification, read our guide to Apple Reference Image and photo authenticity.
Frequently Asked Questions
Does it automatically block every scam payment?
No. Support and the response depend on the app, and detection cannot be treated as a guarantee.
Does Unknown mean safe?
No. It means the assessment did not detect suspicious evidence, rather than establishing that the action is trustworthy.
Should I disable it when someone asks?
Do not change protection settings under pressure. Verify the request independently, especially if the person is also directing a payment or account change.