iOS 27 Impersonation Risk Detection: What to Check

Open Settings on an iPhone running iOS 27 and, according to one report, you'll find a new iOS 27 Impersonation Risk Detection toggle sitting inside Privacy & Security. It's designed to flag when your behavior during a wire transfer, a high-value payment, or a change to a critical security setting looks like someone is coaching you through a scam in real time (Tom's Guide, today).

Strip away the technical language and here's what this iPhone scam protection feature reportedly does: your phone runs an on-device assessment of how you're acting right before a sensitive transaction, then hands the requesting app a risk score so it can decide whether to add friction before you send money or change a critical security setting.

The setting is reportedly off by default, so anyone who's already updated to iOS 27 won't see any change unless they go find it themselves. You have to open Settings > Privacy & Security and turn it on manually, and Apple reportedly warns it can take up to 24 hours after enabling for the protection to fully activate across compatible apps (Tom's Guide, today).

Everything in this article about how the feature behaves traces back to that single outlet's reporting. Apple's own iOS 27 rollout announcement, published earlier this month, covers new features across iOS 27, iPadOS 27, macOS 27, watchOS 27, visionOS 27, and tvOS 27, but the version of that announcement reviewed for this piece does not name or describe Impersonation Risk Detection anywhere (Apple Newsroom, earlier this month).

That gap doesn't make this Apple anti-scam feature fake, but it does mean everything below should be read as reported behavior rather than documented fact. Apple separately says its App Store systems prevented more than $2.2 billion in potentially fraudulent transactions in 2025 (Apple Newsroom, earlier this year). That figure shows Apple's broader fraud-prevention work across its platforms; it doesn't confirm that this specific iOS feature exists or works as described.

How iOS 27 Impersonation Risk Detection reportedly works

As described, the feature only activates when you attempt something risky inside an app that has integrated it, such as sending a wire transfer, making a high-value payment, or changing a critical security setting. At that moment, the app can ask iOS 27 for a real-time risk assessment before letting the action go through (Tom's Guide, today).

That assessment reportedly happens on-device. iOS 27 is said to weigh interaction timing, behavioral patterns, context, and basic sensor data to judge whether you might be acting under pressure from someone else (Tom's Guide, today). The result lands in one of three reported tiers:

• Unknown: no actionable data or normal usage pattern detected
• Medium: minor unusual activity flagged
• High: significant indicators of suspicious or manipulated behavior detected

The app reportedly only receives that final label, not the raw signals behind it, and can use it to trigger protective measures such as requiring extra identity verification, delaying the transaction, or showing a warning banner (Tom's Guide, today). The report defines Medium and High at a high level, but it doesn't spell out what a given app is supposed to do differently at each tier, whether apps handle the two levels consistently, or whether you can override a delay or block once one triggers.

What turning it on actually shares

Apple reportedly never reads the content of your Photos, Messages, or Mail to make this judgment (Tom's Guide, today). That claim covers content analysis specifically. It doesn't say what the "limited event signals" shared with app developers and Apple's diagnostic servers actually contain, how long they're kept, or who besides the requesting app can see them, and nothing in the reporting reviewed for this piece answers those questions either.

That's the trade Apple is reportedly asking you to make by flipping the toggle: some event data leaves your device and reaches app developers and Apple's own systems, in exchange for a risk score during sensitive actions. Read the on-screen consent language yourself before deciding whether that trade is worth it for you. Don't assume enabling it is a free, no-downside move just because it doesn't cost money.

How to turn on iOS 27 Impersonation Risk Detection

If you want to check your own iPhone, the reported path involves a few steps rather than a single tap. Open Settings, scroll down, tap Privacy & Security, then look for an entry called Impersonation Risk Detection and switch it on (Tom's Guide, today).

Finding that toggle only confirms a label with that name exists on your device. It doesn't prove the underlying risk-assessment system actually works as described, since that depends on apps you use actually requesting assessments.

If the entry is there, the screen reportedly includes consent language about sharing event signals with app developers and Apple's diagnostic systems, along with a Recent Activity log that lists which apps have requested an assessment and what triggered it (Tom's Guide, today).

An empty Recent Activity log after the reported 24-hour activation period doesn't mean the feature is broken. It could simply mean none of the apps on your phone have integrated it yet. Don't start a real wire transfer or change a real security setting just to see if it fires; that's not a test worth the risk.

Which apps and iPads support iOS 27 scam warnings?

The Tom's Guide report reviewed for this article does not name a single compatible app. No bank, payment service, crypto platform, or marketplace is identified as actually requesting these risk assessments, so there's no way to confirm whether turning the toggle on does anything for the apps you personally use. That also leaves device eligibility, regional availability, and account requirements resting on a single source until Apple documents the feature directly (Tom's Guide, today).

For a better read on app support than a customer-service chat will give you, check that app's own release notes or support pages for language naming Impersonation Risk Detection or equivalent risk-assessment support. If a support rep can't confirm it by name, treat that as inconclusive rather than proof the app doesn't work with the feature.

iPad scam protection through this specific feature is also unclear. The feature-specific reporting refers only to iOS 27, never to iPadOS. Apple's rollout note from earlier this month confirms that iOS 27, iPadOS 27, macOS 27, watchOS 27, visionOS 27, and tvOS 27 all launched together, but nothing in that announcement ties Impersonation Risk Detection to iPadOS specifically (Apple Newsroom, earlier this month). Plenty of iPhone features land on iPad in the same release, and plenty don't right away, so treat iPad support as unknown rather than assume it's just delayed.

Three things would move any of this from reported toward confirmed: an Apple support or developer page that names the feature outright, a bank or payment app's release notes that explicitly cite support for it, or your own Recent Activity log showing a named app actually made a request. Until one of those shows up, treat descriptions of how the system behaves internally, and which platforms and apps it covers, as unverified.

What this feature can't protect you from

The privacy framing here, that Apple doesn't read your Photos, Messages, or Mail content, describes what data the feature avoids touching. It says nothing about how accurately the system catches real scams. Nothing in the reporting reviewed for this article includes a false-positive rate, a false-negative rate, an independent security review, or a documented real-world case of a scam this feature stopped. That leaves no real basis yet for trusting a High score as reliably accurate, or assuming a Medium or Unknown score means you're safe.

The report describes support limited to apps that choose to integrate the capability, not calls, texts, or browsers, which is exactly where a lot of impersonation fraud already happens.

If you think you're being scammed right now, none of that matters as much as basic habits. Stop the transaction, hang up or close the conversation, and contact your bank or payment provider through a number or app you already trust, never one given to you by the person contacting you.

What to do now

The evidence here falls into three categories. A Settings entry matching this description is reported by one outlet (Tom's Guide, today). Whether it shows up on your own iPhone is something you can check yourself in Settings > Privacy & Security. Whether Apple has officially documented its existence, behavior, or which apps support it remains unconfirmed as of Apple's own iOS 27 announcement from earlier this month (Apple Newsroom, earlier this month).

If the toggle is present and you're comfortable with the consent language as written, turning it on is a reasonable bet. Just treat it as one data point rather than proven protection until a specific app you use shows up in Recent Activity or that app's maker documents support directly.

This remains an app-mediated signal, not a phone-wide shield. It cannot intervene in a phone call, text thread, or browser tab. Until Apple and app developers document its actual reach, pause before acting on pressure, verify independently, and contact any organization through a channel you already trust rather than one it hands you.