In Orwell’s 1984, one terrifying line comes from O’Brien, who tells Winston Smith that “If you want a picture of the future, imagine a boot stamping on a human face — forever.” I’d argue that all you really need to be terrified of the future is to browse the Spam folders in Messages or Gmail. It’s a non-stop wave of scams, targeting our emotions and lack of skepticism.
That intro might sound like fearmongering — but given that victims can lose thousands of dollars, and sometimes their lives, online scams are a legitimate threat that makes you question the goodness of humanity. One new defense in the war is Apple’s Impersonation Risk Detection, rolling out alongside iOS 27 and iPadOS 27. I’d recommend turning it on immediately, whether or not your inbox is bombarded with spam the way mine is.
What is Impersonation Risk Detection, and how do you turn it on?
Protection against some of the worst scammers
The most effective scams fall under the category of something called social engineering. That is, an attacker mimics an entity you normally trust, such as a bank, a phone carrier, or a government agency like the US Social Security Administration. Sometimes the scammer goes for the jugular, prompting you to share money or sensitive info right away, either directly or though a phishing website. Patient scammers may build up your trust, say by flirting or pretending to be a family member. Inevitably, though, they’ll ask for something you shouldn’t give them. When you do, they’ll disappear. Romance scams are some of the most heartbreaking things you’ll ever read about.
With a compatible app, Impersonation Risk Detection (IRD for short) uses both your Apple account and device data to judge whether an action you’re taking might be risky. As Apple explains it, that data includes “patterns, timing, context, and basic sensor data,” but is analyzed on-device, so it’s not uploaded to the company’s servers. All that’s sent is the calculated risk level, as well as the broader action you were taking. Third-party app developers only get the risk level. Apple further insists that it never analyzes the content of your iPhone or iPad’s native Photos, Messages, or Mail apps.
When an app calls for a risk assessment, the feature returns one of three results: Unknown, Medium, or High. Unknown is actually the lowest level, but since mistakes are possible, Apple wants everyone to stay on guard. It’s up to developers to decide how an app responds. Realistically, it’s safe to say that if the level is Medium or High, an app will at least warn you.
To enable IRD, you first have to install iOS 27 or iPadOS 27. I could see Apple retroactively adding this to earlier software, but its priority is the platforms most people will use going forward. It’s not yet available for macOS 27 Golden Gate, as of this writing — though Apple’s language suggests it might be coming to other operating systems.
Update your iPhone or iPad by going to Settings -> General -> Software Update. I’d recommend having 50% battery or more, and you’ll want to be on Wi-Fi for the sake of download speed. Your device will be out of commission for several minutes once installation starts.
Once the update is done, follow these steps:
- Go to Settings -> Privacy & Security.
- Scroll down, then tap on Impersonation Risk Detection.
- Toggle Share with App Developers. You may be prompted to sign in to the App Store using your Apple account.
Notably, since scammers might try to trick you into turning the feature off, there’s a built-in delay in modifying it once it’s on. It may take up to 24 hours for a change to take effect.
After a while, compatible apps and their recent activity should appear in the IRD menu. You can disable individual apps, but expect the delay I just mentioned.
Are there any downsides to Impersonation Risk Detection?
Sins of omission
It’s hard to judge this early on, but on the surface, not really. Apple is typically considered very reliable when it comes to privacy, and third-party app makers can’t use this as a way of harvesting your info. Potential scammers aren’t being notified, either.
Hypothetically, the feature could prove overly sensitive, or not sensitive enough. Some warning is better than nothing however, as long as it doesn’t supersede better in-app technologies. Apps like Messages, Chrome, and Safari already include a few defenses, for instance anti-phishing warnings.
If anything, it’s third-party app support that’s the biggest issue. Developers have to opt into IRD, so at a minimum, they need to code compatibility, test it, then wait for their update to be approved by Apple. If a company already has some sort of anti-scam technology, they may be more inclined to stick with that. It’s less effort, with more transparency. When a developer relies on IRD, it’s putting a bit of blind faith into Apple’s detection algorithms.
That’s somewhat ironic, since your best protection against scams is critical thinking. If a stranger’s offer sounds tempting, or their warning too cataclysmic, it’s time to take a step back. You should always, always scan any web links you’re asked to visit before you tap on them. If the root of a URL doesn’t match up with a company’s normal address, stay away.
