Apple adds new anti‑bank fraud feature in iOS 27, disabled by default

Apple has launched iOS 27 featuring a new “Impersonation Risk Detection” tool aimed at banking fraud that relies on impersonating banks or government entities. The system analyzes the context of user interactions within apps to gauge risk before completing payments or changing credentials.

How the feature works

When a user initiates a payment or attempts a password change, the app requests a risk assessment from the device. The iPhone examines timing data, behavioral patterns, and basic sensor inputs to classify risk as unknown, medium, or high, performing all analysis locally without sending message or image content to Apple’s servers.

After scoring, the app receives the risk level and decides the appropriate action independently of Apple. To enable the feature, go to Settings → Privacy & Security → Impersonation Risk Detection, turn on sharing assessments with developers, and sign in to the App Store first.

Current limitations

The feature is disabled by default and works only in apps that support it; Apple has not yet published a list of compatible apps. Consequently, users may enable it without knowing whether their bank or payment wallet utilizes the assessments. Changes to the setting can take up to 24 hours to become effective, a safeguard against scammers convincing users to disable protection during fraudulent calls.

At present, the practical impact remains limited until banks and payment providers adopt broader support, making this more of a preparatory step than a comprehensive solution.

This move reflects Apple’s commitment to strengthening digital transaction security, though full effectiveness will depend on wider financial industry collaboration.