How to Turn On Impersonation Risk Detection in iOS 27

Most phone scams don't break into your account. They convince you to do the work: a caller pretends to be your bank, a "government agent" says your money is at risk, or a message from someone you trust asks you to move funds right away. Two-factor authentication can't stop that, because you are the one approving the payment.

iOS 27 adds a new tool aimed at exactly this kind of fraud. It's called Impersonation Risk Detection, and it is turned off by default. This guide explains what it does, what data it uses and how to switch it on and manage it on your iPhone.

What Impersonation Risk Detection does

When the feature is on, a supported app (for example, a banking or payment app) can ask iOS for a risk check at the moment you do something sensitive, such as sending a payment, signing in or changing your password. Apple analyzes signals from your device and Apple Account and gives the app one of three risk levels:

• Unknown: no signs of suspicious activity were found. Apple notes this does not mean the action is confirmed safe.
• Medium: some signs of suspicious activity were found.
• High: significant signs of suspicious activity were found.

The app then decides what to do. It might show a scam warning, add a delay or ask you to verify your identity again. Apple does not control the app's response, and the app gets only the risk level, not the data behind it.

Before you start

• Your iPhone must run iOS 27 or later (the feature is also in iPadOS 27). To check, go to Settings > General > Software Update.
• You may need to be signed in to the App Store with your Apple Account to turn it on.
• It only works in third-party apps that support it. Apple has not published a list of supported apps, so it will depend on your bank and payment apps adding support.

How to turn on Impersonation Risk Detection

1. Open the Settings app on your iPhone.
2. Tap Privacy & Security.
3. Scroll down and tap Impersonation Risk Detection.
4. Turn on Share with App Developers.
5. If iOS asks you to sign in with your Apple Account, do so, then go back and confirm the switch is on.

That's all you need to do. From now on, supported apps can request a risk check when you take a risky action. You won't see anything unless an app decides to warn you or ask for extra verification.

How to see which apps used it

The same settings screen also works as an activity log, so you can see what is happening:

1. Go to Settings > Privacy & Security > Impersonation Risk Detection.
2. Under Recent Activity, check which apps have requested a risk assessment.
3. Under Reasons for Access, see which actions triggered each request, such as a payment or a sign-in.

How to turn it off for one app

1. Open Settings > Privacy & Security > Impersonation Risk Detection.
2. Tap the app you want to change.
3. Turn off the toggle for that app.

To turn the whole feature off, switch off Share with App Developers on the main screen.

Why changes can take up to 24 hours

Apple says changes to this setting, both the main switch and per-app access, may take up to 24 hours to take effect. This delay is on purpose. Scammers often guide victims step by step through their phone's settings. If someone could make you turn off the protection and then send money a minute later, the feature would be useless. Apple's advice is simple: if anyone tells you to turn this feature off, you may be talking to a scammer. Hang up and contact your bank using the number on your card or its official app.

What data it uses

Apple's support page and privacy notice describe the process like this:

• Your iPhone looks at usage patterns, such as whether you are sharing your screen and roughly how many calls and emails you have recently received. Apple says this analysis happens on the device, and Apple does not receive that raw data.
• The on-device assessment is then combined with Apple Account information, such as your recent App Store downloads and purchases, to produce the risk signal.
• Apple learns the type of action you tried (for example, a sign-in or payment), but according to its privacy notice, not which app you used or what you did in it.
• Apple says it never analyzes the content of your Photos, Messages or Mail for this feature.

Troubleshooting

• The option is missing: make sure you have installed iOS 27 or later, then restart the iPhone and look again under Privacy & Security.
• The switch won't stay on: check that you are signed in to the App Store with your Apple Account. Apple says you may need to be signed in before the feature can be enabled.
• Nothing seems to happen: that's normal. The feature only works when a supported app asks for a check, and the Recent Activity list will stay empty until one does.

Our take

Impersonation Risk Detection doesn't block scam calls or texts. Instead, it gives your bank's app a hint that something may be wrong at the moment it matters most. It is off by default, it uses a limited set of signals, and you can review every request, so there is little reason not to turn it on, especially on the iPhones of older relatives, who are often targeted by these scams. How useful it becomes will depend on how many banks and payment apps add support. Apple has not named any partners yet.

Sources: Apple Support (About Impersonation Risk Detection), iPhone User Guide, Apple Privacy notice, 9to5Mac