iOS 27 has a hidden anti-scam setting — here’s why every iPhone user should turn it on

With iOS 27, Apple is introducing a native line of defense called Impersonation Risk Detection to tackle increasingly sophisticated social engineering scams.From convincing fake text messages to callers posing as government agents or bank representatives, these attacks are notoriously difficult to block because traditional phone security struggles when a victim is tricked into voluntarily initiating a payment or sharing account details.Designed to spot potential fraud in real time, this new system-level feature in iOS 27 acts as a built-in safety net, warning you (and supported third-party apps), when an interaction shows signs of a scam before you hand over sensitive information or money.How Apple spots scams without reading your private messages (Image credit: Shutterstock)Unlike invasive security tools that scan your personal files, Impersonation Risk Detection is built around Apple’s privacy-first architecture.When you attempt a sensitive action inside a supported app, such as sending a wire transfer, making a high-value payment, or changing critical security settings — the app can request a risk assessment from iOS 27.On the device, Apple analyzes interaction timing, behavioral patterns, context, and basic sensor data to determine if you might be acting under the influence of a scammer.Based on this on-device analysis, iOS 27 assigns one of three risk levels:Get instant access to breaking news, the hottest reviews, great deals and helpful tips.Unknown: No actionable data or normal usage pattern detected.Medium: Minor unusual activity flagged.High: Significant indicators of suspicious or manipulated behavior detected.Crucially, Apple never reads or analyzes the content of your Photos, Messages, or Mail.The app only receives the final risk level score, allowing it to trigger protective measures like requiring extra identity verification, delaying a transaction, or displaying an urgent warning banner.Why the feature is turned off by defaultBecause Impersonation Risk Detection requires sharing limited event signals with app developers and system diagnostic servers, Apple leaves the feature disabled by default upon updating to iOS 27.To take advantage of the protection, you must manually opt in through your settings.How to turn on Impersonation Risk Detection in iOS 27To set it up, open Settings on your iPhone, scroll down, and tap Privacy & Security.Next, locate and select Impersonation Risk Detection, and then simply toggle the main switch to on to grant consent for supported apps to request real-time risk assessments. (Image credit: Tom's Guide)Apple notes that after enabling the toggle, it can take up to 24 hours for the protection signals to fully activate across compatible apps.Once active, you can return to this same menu at any time to view Recent Activity, giving you full visibility into which apps have requested a risk assessment and the specific actions that triggered them.Will you be turning on Impersonation Risk Detection, or do you prefer to keep sharing toggled off? Let us know in the comments. (Image credit: Future)Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button!More from Tom's Guide I finally unlinked my iPhone alarm from my ringer volume — here is where Apple hid it in iOS 27Siri in iOS 27 actually lives up to the hype — here are 3 truly unique usesApple added 5 new lock screen tools in iOS 27 — here's what to change first