ZDNET’s key takeaways
- Apple has unveiled a new security option called Impersonation Risk Detection.
- Added in iOS 27 and iPadOS 27, this tries to protect you from social engineering scams.
- Apps that support the feature will warn you of a potential threat.
Social engineering scams often succeed because they evade traditional security protections to trick you into doing something that puts you at risk. Now, Apple has created a new defense designed to protect iPhone and iPad users from these types of scams: Impersonation Risk Detection
Also: A stranger can learn a lot about you in 5 minutes online – how to check and delete it
Apple introduced the new security feature in iOS 27 and iPadOS 27. When enabled, this option will warn you before you take certain actions in a supported app that might lead you to an active scam. The goal is to help you when more traditional security measures like two-factor authentication can’t detect or protect you from a potential threat.
How Impersonation Risk Detection works
Let’s say you’re using an app on your iPhone or iPad that supports Impersonation Risk Detection. You’re about to perform a sensitive action, such as making a payment, changing your password, or sharing your account details. Impersonation Risk Detection steps in to analyze your Apple account and the information on your device to look for signs of a scam.
Based on the results, Apple will send one of the following three risk levels to the app:
- Unknown: This means that no suspicious activity was detected, but it doesn’t confirm that the action you’re about to take is safe.
- Medium: This indicates that some signs of suspicious activity were detected.
- High: This means that significant signs of suspicious activity were detected.
The app then decides what to do next. If a high level of suspicious activity is found, the app could ask you to verify your identify, show a warning, or delay your action before it gets you into trouble. The app makes this determination, not Apple.
Also: I’ve used my iPhone 18 Pro for a week – these 5 features make the upgrade worth it
Apple will analyze certain information related to an interaction to generate the risk level, but it never receives the data itself. The company doesn’t analyze your content in such apps as Mail, Messages, and Photos. But Apple does learn the type of action you attempted when an app requests a risk assessment. Supported apps receive only the risk level and not the data used to create it.
Impersonation Risk Detection is turned off by default because a supported app requires a certain level of access to your actions and activities.
How to enable Impersonation Risk Detection
To enable the setting in iOS 27 or iPadOS 27, go to Settings and select Privacy & Security. Swipe toward the bottom of the screen and tap the setting for Impersonation Risk Detection. At the next screen, turn on the switch for “Share with App Developers.” After turning this setting on, you may have to wait 24 hours for it to take effect.
Also: Mobile phishing is a bigger threat than email now – how to stay protected
Any apps that participate in Impersonation Risk Detection will appear on the same screen, so you can always check them periodically for recent activity. You’ll see which apps asked for a risk assessment and which actions triggered the request. Here, you can also turn off access for individual apps.
Both built-in and third-party apps can support the feature, though Apple didn’t list any specific programs on its support page. However, with social engineering scams so pervasive, hopefully enough apps will jump on this bandwagon to better prevent people from becoming victims.
