Apple’s iOS 27 Adds a New Defense Against Bank Impersonation Scams, But You Need to Turn It On
Apple has introduced a new iPhone security feature in iOS 27 designed to fight one of the most dangerous types of scams: impersonation fraud. The feature, called Impersonation Risk Detection, is aimed at situations where even two-factor authentication may not be enough to protect you.
The update arrived on September 14, but there is one important catch. Impersonation Risk Detection is switched off by default, meaning iPhone users must enable it manually before supported apps can use it.
This new protection is built for scams where a criminal pretends to be someone trustworthy, such as a bank representative, government official, delivery service, tech support agent, or even a family member. The attacker then pressures the victim into sending money, changing account details, approving a transaction, or sharing access.
The problem with these scams is that traditional security tools often struggle to stop them. If you are the one approving the payment or changing the password, the system may see the action as legitimate, even if you are being manipulated in real time. This is the same weakness exploited in scams involving stolen login sessions, fake support calls, and AI-generated voice cloning.
How Impersonation Risk Detection Works on iPhone
Instead of simply checking a phone number, message, or email address, Apple’s new feature looks at the situation around the action.
When you begin a sensitive task, such as making a payment or changing a password, a supported app can ask the iPhone to assess the risk. The device then analyzes signals such as interaction patterns, timing, context, and basic sensor information.
The assessment happens directly on the iPhone. Apple says the system does not analyze the content of your Photos, Messages, or Mail. The app does not receive raw personal data either. Instead, it receives a simple risk level: unknown, medium, or high.
After that, the app decides what to do. For example, a banking app could show an additional warning, delay a transaction, ask for extra confirmation, or block a suspicious action. Apple does not control how each app responds to the risk level.
How to Turn On Impersonation Risk Detection in iOS 27
To enable the feature, open Settings on your iPhone, then go to Privacy & Security. Scroll down until you find Impersonation Risk Detection, then turn on Share with App Developers.
Apple says you may need to be signed in to the App Store with your Apple Account before the setting can be enabled.
There is also a delay to be aware of. Changes to this setting can take up to 24 hours to take effect. That delay appears to be intentional. If a scammer calls you and pressures you to turn the feature off immediately, the change will not help them right away.
The Biggest Limitation: Apps Must Support It
While the feature is promising, it is not a complete shield yet. Impersonation Risk Detection only works with apps that choose to support it. Apple has not released a public list of participating banking apps, payment services, crypto wallets, or financial platforms.
That means you can enable the setting today and still not know whether your bank is using it.
There is one way to check over time. The Impersonation Risk Detection settings page includes a Recent Activity section. Once apps begin requesting risk assessments, this area will show which app asked for an assessment and what triggered it.
Until then, the feature should be seen as a foundation for stronger scam protection, not something users can fully rely on immediately.
Why This iOS 27 Feature Matters
Bank impersonation scams are becoming more convincing. Criminals now use spoofed phone numbers, stolen personal details, fake websites, urgent messages, and even cloned voices to make victims believe they are speaking to a real institution.
Two-factor authentication is still important, but it cannot always stop scams where the victim is tricked into approving the action themselves. That is why Apple’s new approach is notable. It attempts to detect suspicious circumstances around a transaction, not just whether the user entered the right password or verification code.
For iPhone users, turning on Impersonation Risk Detection takes only a couple of minutes and shares minimal information with apps. The real value will depend on how quickly banks, payment providers, and financial apps adopt it.
For now, iOS 27 gives users an extra layer of protection against impersonation scams, but the feature is only useful if enabled and supported by the apps people use most.
