Someone calls claiming to be your bank. They know your name, your last transaction, and exactly which account to “secure.” They just need you to confirm a payment or update your credentials. That scenario is where conventional protections can fall short: phishing filters may not catch a voice call, and two-factor authentication provides limited protection when you are pressured into handing over the code yourself. iOS 27 adds a new opt-in setting aimed at this gap, called Impersonation Risk Detection.
The feature does not automatically block scams across your device. It gives compatible apps a risk signal before you complete a sensitive action.
How It Works
The feature works by letting supported apps request a real-time risk assessment from Apple at the moment you attempt something sensitive.
When you try to send a payment or change account-security details inside a supported app, the app can request an assessment. Apple analyzes signals from your device and Apple Account, then returns one of three risk levels to the app, according to Apple support documentation.
“Unknown” means no evidence of suspicious activity was detected, though Apple is clear this does not confirm the action is safe. “Medium” indicates some signs of suspicious activity, and “High” signals significant signs of suspicious activity.
Think of it like a credit card fraud flag: your bank does not always cancel a suspicious charge automatically, but it may pause the transaction and ask you to confirm. Impersonation Risk Detection works on a similar principle, except the app, not Apple, decides what happens next.
Depending on how a developer implements the feature, the response could be an additional verification step, a time delay, or a warning. Apple determines the risk level; the app determines the consequence.
How to Enable It
The feature is off by default and requires four taps to activate.
Open Settings, tap Privacy and Security, scroll down to Impersonation Risk Detection, and turn on the Share with App Developers toggle. Apple notes that signing in to the App Store with an Apple Account may be required before the toggle becomes available.
What It Cannot Do
Enabling the setting does not activate protection across every app on your phone.
Only compatible third-party apps can request an assessment. Apple had not published a complete public list of which apps support the feature at the time of publication, according to 9to5Mac.
The app receives the risk level only, not the underlying information Apple used to generate that result. An Unknown rating is not a clean bill of health; it means no suspicious signals were detected at that moment, not that the person contacting you is legitimate.
You still need to verify unexpected requests through official channels. Never share passwords, authentication codes, or financial information under pressure from any caller, text, or message. That rule holds regardless of what any risk assessment returns.
The Practical Reality
The feature’s usefulness depends on how many apps adopt it and how developers choose to act on the signal.
Impersonation Risk Detection could provide useful infrastructure for banking, payment, and account-management apps. Its real-world value will depend on developer adoption and whether a high-risk signal produces a meaningful intervention rather than a generic warning users dismiss.
Turning it on costs nothing. If the setting is off, supported apps cannot use the feature for assessments on your behalf at all.
