iOS 27 and iPadOS 27 include Impersonation Risk Detection, an opt-in feature that helps banking and other apps spot when you might be acting under pressure from a scammer. It is off by default, so you need to switch it on yourself. Apple Support explains how it works and how to enable it.
What Impersonation Risk Detection does
The feature targets social engineering scams, in which someone poses as your bank, a government agency or a person you trust and talks you into sending money or changing account details. Two-factor authentication cannot stop this, because you are the one taking the action.
When you do something that is especially risky during a scam in a supporting app, such as making a payment or changing your password, the app can ask iOS for a risk assessment. Based on information about your device and Apple Account, the system returns one of three levels:
- Unknown: no evidence of suspicious activity was detected. This does not mean the action is confirmed as safe.
- Medium: some signs of suspicious activity were detected.
- High: significant signs of suspicious activity were detected.
The app decides what to do next, for example asking you to verify your identity, adding a delay or showing a warning. Apple does not control the app’s response.
How to turn it on
- Open the Settings app on your iPhone or iPad.
- Tap Privacy & Security, then scroll down and tap Impersonation Risk Detection.
- Turn on Share with App Developers. You may need to sign in to the App Store with your Apple Account.
The feature only works in apps that support it, and Apple has not published a list of those apps.
Why changes can take 24 hours
Apple warns that if someone tells you to turn the feature off, you may be the victim of a scam. To protect you, changes to the setting can take up to 24 hours to take effect. The same delay applies when you change access for individual apps.
How to see which apps used it
In the Impersonation Risk Detection settings, Recent Activity shows which apps have requested a risk assessment, and Reasons for Access shows the actions that prompted each request. Tap an app and turn off its toggle to stop it using the feature.
What Apple can and cannot see
Apple says the risk level is generated on-device from interaction patterns, timing, context and basic sensor data, so Apple never receives that data. It never analyses the content of your Photos, Messages or Mail. Apple does learn which type of action you attempted when an app requests an assessment, and apps receive only the risk level, never the underlying information.