// ZDNET — MOBILE & WEB
Your iPhone just got a hidden anti-scam upgrade in iOS 27: How to enable it
Tech > Services & Software > Operating Systems > Mobile OS > iOS
New with iOS 27 (and iPadOS 27) is a setting called Impersonation Risk Detection that aims to warn you of suspicious activity that could trap you in a scam.
Social engineering scams often succeed because they evade traditional security protections to trick you into doing something that puts you at risk. Now, Apple has created a new defense designed to protect iPhone and iPad users from these types of scams: Impersonation Risk Detection
Also: A stranger can learn a lot about you in 5 minutes online – how to check and delete it
Apple introduced the new security feature in iOS 27 and iPadOS 27. When enabled, this option will warn you before you take certain actions in a supported app that might lead you to an active scam. The goal is to help you when more traditional security measures like two-factor authentication can’t detect or protect you from a potential threat.
Let’s say you’re using an app on your iPhone or iPad that supports Impersonation Risk Detection. You’re about to perform a sensitive action, such as making a payment, changing your password, or sharing your account details. Impersonation Risk Detection steps in to analyze your Apple account and the information on your device to look for signs of a scam.
Based on the results, Apple will send one of the following three risk levels to the app:
The app then decides what to do next. If a high level of suspicious activity is found, the app could ask you to verify your identify, show a warning, or delay your action before it gets you into trouble. The app makes this determination, not Apple.
Also: I’ve used my iPhone 18 Pro for a week – these 5 features make the upgrade worth it
Apple will analyze certain information related to an interaction to generate the risk level, but it never receives the data itself. The company doesn’t analyze your content in such apps as Mail, Messages, and Photos. But Apple does learn the type of action you attempted when an app requests a risk assessment. Supported apps receive only the risk level and not the data used to create it.