Your iPhone just got a hidden anti-scam upgrade in iOS 27: How to enable it

Apple has added a security option called Impersonation Risk Detection in iOS 27 and iPadOS 27, according to ZDNET. The feature is intended to protect iPhone and iPad users from social engineering scams by warning them before they take certain actions in a supported app that might lead to an active scam.

When enabled, the setting works ahead of sensitive actions such as making a payment, changing a password, or sharing account details. Impersonation Risk Detection analyzes the user's Apple account and information on the device for signs of a scam, then sends the app one of three risk levels: Unknown, meaning no suspicious activity was detected but the action is not confirmed safe; Medium, meaning some signs of suspicious activity were found; or High, meaning significant signs were found. The app, not Apple, decides what to do next, and could ask the user to verify their identity, show a warning, or delay the action.

Apple does not receive the data used to generate the risk level, and does not analyze content in apps such as Mail, Messages, and Photos, though it does learn the type of action attempted when an app requests a risk assessment. Supported apps receive only the risk level.

The feature is turned off by default because a supported app requires a certain level of access to a user's actions and activities. To enable it in iOS 27 or iPadOS 27, users go to Settings, select Privacy & Security, swipe toward the bottom, tap Impersonation Risk Detection, and turn on the switch for "Share with App Developers." The setting may take 24 hours to take effect.

Participating apps appear on the same screen, where users can review recent activity, see which apps requested a risk assessment and which actions triggered it, and turn off access for individual apps. Both built-in and third-party apps can support the feature, though Apple did not list specific programs on its support page.