Apple has introduced a new anti-scam feature called Impersonation Risk Detection with iOS 27, designed to help supported apps recognize when a user may be acting under the influence of a scammer. The tool targets social engineering scams, where criminals pressure or guide victims into sending money or changing sensitive account information themselves. Unlike traditional security measures that block malware or unauthorized logins, this feature addresses situations where the legitimate account holder is manipulated into taking harmful actions.
When a user performs certain sensitive actions inside a supported third-party app, such as making a payment or changing a password, the app can request a risk assessment from Apple. The system returns one of three risk levels, and the app decides how to respond. It might ask the user to verify their identity, delay the action, or display a warning before proceeding. This gives users an extra opportunity to pause when a scammer is rushing them through a payment or account change.
Apple says the feature analyzes signals related to device usage, including interaction patterns, timing, context, and basic sensor data. The iPhone may consider whether the screen is being shared and the approximate number of recent phone calls or emails received. It can combine this with certain Apple Account information, such as recent App Store downloads and purchases, to look for unusual behavior that could suggest someone is guiding or pressuring the user. However, the feature only works with third-party apps that support Apple's system, and Apple says it never analyzes the content of Photos, Messages, or Mail.
Privacy is a key consideration. The iPhone creates an on-device assessment and sends that assessment, rather than the underlying device data, to Apple. Apple can then combine it with certain Apple Account activity to generate final risk signals. Apple also learns the category of activity being attempted, such as signing in or making a payment, but does not learn which app requested the signals or the content of what the user was doing inside the app. The requesting app receives only the resulting risk level, not the underlying information.
Users must manually enable the feature. Share with App Developers starts out turned off, so simply updating to iOS 27 does not activate the protection. To turn it on, go to Settings, then Privacy & Security, then Impersonation Risk Detection. Apple notes that changes may take up to 24 hours to take effect. After enabling it, users can return to that menu to see which apps have recently requested a risk assessment, review why each app requested access, and turn off access for individual apps.
Apple also warns that if someone on the phone tells you to disable Impersonation Risk Detection, you might be dealing with a scammer. Such a request should be treated as a major red flag. Hang up and contact the company using a number or app you already trust.
Android users are not left out. Google Pixel and Samsung Galaxy phones have their own built-in scam protections. On many Galaxy phones, Caller ID and spam protection is the main setting to check. Samsung uses technology from Hiya to identify suspected spam, scam, and potential fraud calls, including numbers not saved in contacts. Samsung also offers a separate real-time Scam detection feature on some compatible Galaxy phones running One UI 8.5 or higher. That feature can analyze calls for scam patterns and alert the user with a tone or vibration. However, it does not appear on every Galaxy phone, even when running current software.
Samsung began rolling out One UI 9 in September 2026, starting with the Galaxy S26 series after its debut on Samsung's newest foldables. Feature availability can vary by model, carrier, and software version. For Pixel users, Google also provides built-in scam protections, though specific settings may differ. Checking these settings on any of these phones is a practical step to reduce the risk of falling victim to increasingly sophisticated scams.