Apple introduced Impersonation Risk Detection as a new security feature in iOS 27 and iPadOS 27 to help reduce active social engineering scams. The feature focuses on situations in which criminals impersonate banks, government agencies, or trusted contacts to pressure users into making payments or changing accounts.

The setting is designed to support apps by providing a scam risk level before sensitive actions occur. Apple states that traditional protections may not catch scams when users are manipulated into completing the action themselves.

iOS 27’s Impersonation Risk Detection is built for scams involving fake identities and social pressure. Common examples include attackers impersonating financial institutions, government services, or people the user knows.

The feature does not decide whether a person is a scammer. Instead, supported apps receive a risk level that can help them add warnings, verification steps, or delays before important actions.

Apple designed Impersonation Risk Detection with privacy controls that limit shared information. The system analyzes device and account signals and sends only a risk level to supported apps, not the details behind that result.

Apple says the feature does not analyze the contents of Photos, Messages, or Mail to create the risk assessment. The company receives information about the type of action requested, such as a payment or password change.

iOS 27 does not automatically activate Impersonation Risk Detection after installation. Users must manually enable the feature, as supported apps require permission to request scam risk assessments.

The option appears under the Privacy & Security settings and requires users to enable Share with App Developers. The feature may take up to 24 hours before changes fully apply.

iPhone users can activate the feature by opening Settings, selecting Privacy & Security, choosing Impersonation Risk Detection, and enabling Share with App Developers. The process takes only a few steps inside the iOS settings menu.

Apple also allows users to review recent activity from apps that request risk assessments. Users can check which apps accessed the feature and restrict individual app access when needed.

Supported apps do not receive personal details from Apple’s security system. Instead, they receive one of three classifications: Unknown, Medium, or High risk based on detected signals.

The risk level helps an app decide what action to take next. A service may request additional identity verification, display a warning, or impose a delay before completing a sensitive action.

Impersonation Risk Detection does not automatically operate across every iPhone app. The feature depends on apps that choose to support Apple’s risk assessment system.

Apple has not published a complete list of participating apps. Users can check the Impersonation Risk Detection section in Settings to see which apps have requested access.

iOS 27’s scam protection focuses on moments when users are about to complete risky actions. Examples include sending money, updating account details, or making security-related changes within supported apps.

The technology addresses a weakness in older security methods, as many social engineering scams succeed when users are convinced to approve actions themselves.

Apple’s system does not send the information used to calculate the risk score to apps. Applications receive only the final risk category and decide how to respond.

The approach gives developers a security signal without providing access to private content. Apple specifically states that the feature does not inspect Photos, Messages, or Mail content for this purpose.

iOS already includes tools that screen unknown calls and filter unwanted messages. iOS 27 adds another layer of protection by helping supported apps detect potential manipulation during sensitive interactions.

Apple’s existing protections can reduce unwanted communication, but Impersonation Risk Detection focuses on scams that trick users into taking action.

The Impersonation Risk Detection menu provides visibility into app requests and security assessments. Users can see which apps requested a risk level and which actions caused the request.

Apple also allows users to disable access for individual apps in the same settings area. Changes to app permissions may also take up to 24 hours to apply.

iOS 27 users who want additional scam protection can check whether Impersonation Risk Detection is enabled. The feature requires manual activation because it shares scam-risk signals with developers of supported apps.

The settings are located under Settings > Privacy & Security > Impersonation Risk Detection. Turning on Share with App Developers allows compatible apps to request scam risk assessments.

Review your settings today to add another layer of protection against impersonation scams. Next, discover why iPhone 18 Pro may be a smarter choice than Apple’s rumored foldable iPhone.