iOS 27 scam protection: turn on this hidden iPhone setting

You turn it on from the Privacy and Security menu in Settings. It works on iPhones running iOS 27 and iPads on iPadOS 27. Here’s the path:

1. Open the Settings app on your iPhone.
2. Go into Privacy & Security.
3. Scroll most of the way down the list and choose Impersonation Risk Detection.
4. Flip on the switch labeled Share with App Developers.
5. Sign in with your Apple Account if your iPhone asks you to.

Then be patient. Apple says the change can take up to 24 hours to kick in. That isn’t a bug. As you’ll see below, the delay is part of the protection.

Don’t let the label put you off. Share with App Developers sounds like something a privacy-minded person should leave alone, which is one reason so few people have enabled it. In practice, the apps get one word, not your data.

It gives supported apps a warning signal at the moment you’re about to do something risky. When you start a sensitive action inside an app that supports it, such as sending a payment, changing a password or sharing account details, the app can ask your iPhone for a risk check.

Your iPhone weighs signals like interaction patterns, timing, context and basic sensor data, then returns one of three levels:

• High: strong signs that something suspicious is going on.
• Medium: some suspicious signs.
• Unknown: nothing was detected. Apple stresses this does not mean the action is confirmed safe.

Apple’s privacy documentation gives a few examples of what counts. Your phone may consider whether you’re sharing your screen and roughly how many calls or emails you’ve received recently. It can combine that with some Apple Account activity, such as recent App Store downloads and purchases. Put together, those signals can reveal the pattern of someone being coached through a transfer by a stranger on the line.

Here’s what surprises people. Even at High, iOS doesn’t freeze the transfer, block the password change or show its own alert. Apple hands the risk level to the app and steps back.

What happens next is up to each app’s developer. A bank app might show a warning, add a waiting period, or ask you to verify your identity again before the money moves. Two apps could treat the same Medium rating differently. That pause is the point: it gives you one more chance to stop while a scammer is rushing you.

The bigger limitation is coverage. The feature only works in apps that have added support for it, and Apple hasn’t published a list. Turning it on today won’t give every app on your phone scam detection, but it means any bank or payment app that adopts it later can start protecting you without you having to remember to come back.

The privacy design is tighter than the toggle name suggests. Apple says your Mail, Messages and Photos content stays out of the analysis entirely. Your iPhone builds its assessment on the device and sends that assessment, not the raw data behind it, to Apple.

Here’s how the information is split:

• The app receives only the risk level. It never sees the signals used to produce it.
• Apple learns the type of action you attempted, like signing in or making a payment. It says it doesn’t learn which app asked or what you were doing inside it.
• You can see everything. Return to the same settings screen to view which apps requested a risk check recently and why.

From that screen you can also turn off access for any single app, or switch the whole feature off if one app starts pestering you with identity checks.

Phone scammers adapt fast. If a caller knew about this feature, an obvious move would be to tell the victim to turn it off, mid-call, before the transfer. The 24-hour delay on switching it off kills that tactic, because the protection stays active for at least a day. It’s similar logic to the security delay in Stolen Device Protection, which slows down changes to key settings when your iPhone is away from familiar places.

Apple adds a simple rule worth memorizing: if anyone on the phone asks you to disable Impersonation Risk Detection, assume you’re talking to a scammer. Hang up and call your bank using a number from your card or its official app.

If you’re reading a tech site, you’re probably not the person most at risk. The people who need this most, often older parents and grandparents, are the least likely to dig four menus deep into Settings for a switch with a confusing name. The best thing you can do this week is turn it on for them.

While you’re in their phone, a few habits make the setting more useful:

• Keep iOS updated so they have the newest version of iOS 27.
• Turn on Stolen Device Protection too, since it guards against a different threat: a thief who knows the passcode.
• Agree on a rule that no real bank asks you to move money to a safe account, ever.

On Android, protection comes from a different direction. Samsung Galaxy phones include Caller ID and spam protection that uses technology from Hiya to flag suspected scam calls, though the exact options vary by model, carrier and software version. Check it under the Phone app’s settings.