Apple just built a pause button for the moment a scammer has you on the line.
iOS 27 added a setting called Impersonation Risk Detection. It's off by default, it takes under a minute to turn on, and it's worth it. It also has limits you should know before you count on it to protect your family. Here's how it works, how to switch it on, and what it leaves wide open.
Photo via StockSnap (CC0)
How Apple's Impersonation Risk Detection works
Apple released iOS 27 and iPadOS 27 on September 14 and published a support page for the feature the same day. It's aimed at what Apple calls active social engineering scams: someone poses as your bank, a government agency or someone you trust, and pressures you into making a payment or changing your account details. Apple says two-factor authentication can't always catch that, "because you're taking the action, even though you've been tricked or pressured."
Here's the flow. When you do something risky inside a supported app, like sending a payment or changing your password, the app can ask your iPhone for a risk check. The phone looks at interaction patterns, timing, context and basic sensor data, right on the device, and hands back one of three levels: Unknown, Medium or High. The app gets only the level, not the data behind it. Then the app decides what happens next. Apple's examples: it might ask you to verify who you are, add a delay or show a warning. Apple says it never analyzes the content of your Photos, Messages or Mail.
One honest caveat, from Apple itself: Unknown "doesn't mean that the action was confirmed as safe." It only means no alarm went off.
Turn it on in two steps
Engadget's walkthrough puts it in two steps, on iPhone or iPad:
- Open Settings and tap Privacy & Security.
- Scroll down to Impersonation Risk Detection and turn on Share with App Developers.
Apple notes you might need to be signed in to the App Store with your Apple Account before the switch will turn on. 9to5Mac and Tom's Guide both report it ships turned off. Do yours, then do your parents' phones the next time you're together.
The same screen shows Recent Activity, which lists apps that have asked for a risk check, and Reasons for Access, which shows the action that triggered each one. Apple hasn't published a list of supported apps yet, so Recent Activity is how you'll find out which of yours use it.
Apple's best tip: anyone telling you to turn it off is the scam
This is the line from Apple's support page worth remembering: "If someone directs you to turn this feature off, you might be the victim of a scam." To blunt that move, changes to the setting can take up to 24 hours to take effect. A scammer works in minutes. They can't wait a day.
So if anyone on a call, text or chat walks you toward this setting, that's your answer. Hang up and call the company back on a number you already trust, like the one on the back of your card.
"If I don't have the number saved, I turn on the skeptic mindset."
Julian M.
What it can't catch
Apple's feature is a smart last-second check. It isn't a call screener, and it doesn't touch the reason scam calls sound so believable now. Two gaps stand out.
A cloned voice of someone you love. The FTC warns that a scammer needs only a short clip of a family member's voice, often pulled from something posted online, plus a voice-cloning program. Then the call comes, and it sounds just like your grandson. Nothing in Apple's description says the feature judges whether the voice on the line is real. It only checks in when you take a risky action inside an app that supports it. If the "grandson" asks for a wire, cryptocurrency or gift card numbers, there may be no supported app in the loop at all. Those are the payment methods the FTC flags, because the money is hard to get back.
The personal details that make the story fit. The call that works is the one that knows your name, your town, your grandson's name and who his parents are. A lot of that sits in plain view on people-search and data-broker sites, for anyone who looks. Impersonation Risk Detection does nothing about it. It works at the final moment, inside one app, and the raw material is still out there for the next call.
"These are tools to help us with our children, not a magical cloak."
Julian M.
How AI Protection helps
To be plain: AI Protection doesn't change your iPhone settings and doesn't screen your calls. Turn Apple's feature on. AI Protection works on the other side of the problem.
First, we go after the data that powers AI attacks: the names, addresses, relatives and phone numbers listed on people-search sites that make a cloned voice sound like it knows you. Less out there means less for a scammer to build with.
Second, we watch for your identity being used. Members are enrolled in Social Security number, dark web, change-of-address, breach, neighborhood watch, and financial account alerts. If your details turn up where they shouldn't, you hear about it. Read what dark web monitoring does and what it doesn't.
Personal is $70 a year (about $5.83 a month) or $7 a month. Cancel anytime. Family Shield is $210 a year for up to 4 people, which covers you and the parents who are most likely to get that call. If someone steals your identity anyway, you're covered for up to $5M.¹
"I wouldn't confuse the individual tools that help keep you safe with the coverage you get from AI Protection."
Julian M.
If it already happened
If you or a parent already sent money or changed a setting during a call, move fast and don't be embarrassed. These scams are built to work on careful people.
- End the call and stop all contact. Don't send anything else, even if they call back with a new reason.
- Call your bank or payment app using the number on your card or inside the app. Tell them it was a scam and ask them to stop or reverse the payment. Hours matter.
- If you shared a password or a verification code, change that password from a device you trust, sign out of all other sessions and turn on two-factor authentication.
- Reach the family member the caller claimed to be, on a number you know is theirs. The FTC's advice is simple: don't trust the voice, verify the story.
- Report it to the FTC at ReportFraud.ftc.gov.
- Turn on Impersonation Risk Detection now, so the next attempt runs into it.
Frequently asked questions
What is Apple Impersonation Risk Detection?
It's an anti-scam feature in iOS 27 and iPadOS 27. When you make a payment or change account security details in a supported app, the app can ask your device for a risk level (Unknown, Medium or High) and then decide whether to warn you, add a delay or ask you to verify your identity.
How do I turn on Apple's scam detector?
Go to Settings, then Privacy & Security, then Impersonation Risk Detection, and turn on Share with App Developers. You might need to be signed in to the App Store with your Apple Account.
Does it detect scam calls on my iPhone?
Not directly. It doesn't screen calls or tell you whether a voice is real. It only gives a risk level to supported apps when you take a risky action, like sending money. Keep treating any urgent call about money as suspect, and call back on a number you trust.
Why does turning it off take up to 24 hours?
On purpose. Apple says that if someone directs you to turn the feature off, you might be the victim of a scam, so changes can take up to 24 hours to take effect. A scammer rushing you can't wait that long.
Does Apple or the app see my personal data?
Apple says the analysis happens on your device, so Apple never receives the data used to make the risk level, and it never analyzes your Photos, Messages or Mail. Apps receive only the risk level. Apple does learn the type of action you attempted, such as a payment.
See what scammers can find about you
Apple can warn you at the last second. The bigger win is giving scammers less to work with in the first place. Our free scan checks more than 200 US data-broker and people-search sites.
¹ Identity theft insurance coverage is provided under a master policy issued by insurance company subsidiaries or affiliates of American International Group, Inc. (AIG) to Identity and Credit Services. Coverage requires reporting stolen identity events within 90 days of discovery.