|
By Rodger Mansfield, Technology Editor
October 29, 2026
Subscribe
Imagine receiving an urgent phone call from someone claiming to represent your bank. They know your name, sound professional, and insist that someone is trying to steal your money.
Their solution? Transfer your savings immediately to a supposedly secure account.
You open your banking app and prepare to send the money. Everything looks legitimate, except for one important detail: The caller is a scammer.
Traditional security features might not catch this situation because you're the person authorizing the transaction.
Apple is addressing this problem with Impersonation Risk Detection, a security feature introduced in iOS 27 and iPadOS 27.
The feature helps participating apps recognize suspicious activity associated with scams, potentially giving you an opportunity to reconsider before making a costly mistake.
Here's a Cool Tip: Enable Impersonation Risk Detection to help supported apps recognize suspicious activity before you complete sensitive transactions.
What Is Impersonation Risk Detection?
Impersonation Risk Detection is designed to identify warning signs associated with social engineering scams.
Social engineering occurs when criminals manipulate people into revealing information, transferring money, or changing account settings.
Instead of breaking into your account, a scammer might convince you to use your legitimate credentials to perform an action that benefits them.
That's why these scams can be especially difficult to detect. Even two-factor authentication may not help when the account owner has been tricked into approving the transaction.
Apple's feature takes a different approach.
When you perform a sensitive action in a participating third-party app, such as making a payment or changing your password, the app can request a risk assessment.
Your iPhone analyzes certain device activity and contextual information. Apple combines an on-device assessment with Apple Account-related information to generate a risk level.
The app receives one of three results:
Risk Level | What It Means
No suspicious activity was detected, but the action is not necessarily safe.
Some signs of suspicious activity were detected.
Significant signs of suspicious activity were detected.
The app then decides how to respond.
For example, it might display a warning, request additional identity verification, or temporarily delay an action.
Apple does not control the app's response, and the feature does not automatically block fraudulent transactions.
It also does not function as a general-purpose scam-call detector.
Instead, it gives participating apps additional information to help protect you when a potentially risky action occurs.
What You'll Gain
-
Extra Scam Protection: Help supported apps recognize potentially suspicious account activity.
-
Safer Transactions: Give participating financial apps another opportunity to evaluate risky payments.
-
Privacy Controls: Choose whether apps can receive risk assessments.
-
Greater Transparency: Review which apps request assessments and the reasons for those requests.
Step-by-Step Instructions
Here's how to do it.
For iPhone and iPad running iOS 27 or iPadOS 27 or later:
-
Open Settings.
-
Select Privacy & Security, scroll down, and tap Impersonation Risk Detection.
-
Turn on Share with App Developers. You may need to sign in to the App Store with your Apple Account.
Participating apps can now request risk assessments when you perform certain sensitive actions.
You do not need to open Impersonation Risk Detection each time you make a payment.
Review Which Apps Use the Feature
You can also manage access for individual apps.
-
Return to Settings > Privacy & Security > Impersonation Risk Detection.
-
Under Recent Activity, review apps that have requested risk assessments.
-
Check Reasons for Access to see which actions prompted the requests.
-
To disable access for a particular app, tap the app and turn off its toggle.
Cool Notes:
- Changes to the main setting or individual app permissions may take up to 24 hours to take effect.
- Apple uses this possible delay to make it harder for scammers to pressure someone into immediately disabling their protection.
| 
