Apple Adds Impersonation Risk Detection to iOS 27 and iPadOS 27

Impersonation Risk Detection is off by default because a supported app requires a certain level of access to a user's actions and activities, ZDNet reported. When a user is about to make a payment, change a password or share account details in a participating app, the feature analyzes the Apple account and information on the device for signs of a scam.

Apple then sends one of three risk levels to the app: Unknown, Medium or High. Unknown means no suspicious activity was detected but does not confirm the action is safe; Medium indicates some signs of suspicious activity; High indicates significant signs of suspicious activity. The app, not Apple, decides what to do next. A high risk could lead the app to ask the user to verify their identity, show a warning or delay the action.

According to ZDNet, Apple analyzes certain information related to an interaction to generate the risk level but does not receive the data itself. It does not analyze content in apps such as Mail, Messages and Photos, though it learns the type of action a user attempted when an app requests a risk assessment. Supported apps receive only the risk level, not the data used to create it.

To enable the setting in iOS 27 or iPadOS 27, users can go to Settings, select Privacy & Security, scroll toward the bottom and tap Impersonation Risk Detection. On the next screen, they can turn on Share with App Developers. The change may take up to 24 hours to take effect. Apps that participate appear on the same screen, where users can check recent activity, see which apps requested a risk assessment and which actions triggered the request, and turn off access for individual apps.

Both built-in and third-party apps can support the feature, according to ZDNet, though Apple did not list specific programs on its support page. The report noted that the feature's effectiveness will depend on how many apps adopt it.