New iPhone Update Offers Impersonation Risk Detection to Combat Scams

Apple's upcoming iOS 27 will feature Impersonation Risk Detection, a new tool designed to help supported applications identify when users may be under the influence of scammers. This feature aims to protect users from social engineering scams where attackers trick individuals into performing actions that compromise their security or finances.

Scammers often impersonate legitimate entities like banks, claiming accounts are compromised or instructing users to move money. These tactics can be convincing enough to make individuals willingly comply with fraudulent requests. Impersonation Risk Detection is intended to provide an additional layer of defense against such sophisticated schemes.

How Impersonation Risk Detection Works on iPhone

Introduced with iOS 27, Impersonation Risk Detection focuses on identifying active social engineering scams. Unlike traditional security measures that block malware or unauthorized logins, this feature addresses scenarios where the user is the legitimate account holder but is being manipulated. When a user performs sensitive actions within a supported third-party app, such as making a payment or changing security information, the app can request a risk assessment from Apple.

Apple then provides one of three risk levels: Unknown, Medium, or High. An 'Unknown' assessment means no suspicious activity was detected, but it does not guarantee safety. A 'Medium' assessment indicates some suspicious signs, while 'High' signifies significant suspicious activity. The app can then choose to respond by prompting for identity verification, delaying the action, or displaying a warning, giving the user a final opportunity to reconsider.

The feature analyzes user interaction patterns, timing, context, and basic sensor data. It may consider factors like screen sharing activity, the number of recent calls or emails, and Apple Account information such as App Store downloads and purchases. The goal is to detect unusual behavior that suggests coercion. However, this feature only functions with third-party apps that have integrated Apple's Impersonation Risk Detection system.

Apple states that it does not analyze the content of Photos, Messages, or Mail for this feature, and the underlying device information used for assessment remains protected. The iPhone generates an on-device assessment which is sent to Apple. Apple may combine this with certain Apple Account activity to generate final risk signals, learning the category of the attempted activity without knowing which app requested it or its content. The requesting app receives only the risk level, not the underlying data.

Impersonation Risk Detection is not enabled by default in iOS 27. Users must manually turn on 'Share with App Developers' in the Settings menu. Apple warns that if someone tells you to disable this feature, it is a significant red flag indicating a potential scam.

To enable Impersonation Risk Detection on iOS 27:

1. Open Settings.
2. Tap Privacy & Security.
3. Scroll down and tap Impersonation Risk Detection.
4. Turn on Share with App Developers.
5. Sign in to the App Store with your Apple Account if prompted.

Changes may take up to 24 hours to take effect. Users can review which apps have requested assessments and disable access for individual apps.

Scam Protection on Android Devices

Samsung Galaxy and Google Pixel phones also offer built-in scam and spam protection tools.

On Samsung Galaxy phones, the 'Caller ID and spam protection' setting, often powered by Hiya technology, helps identify suspected spam, scam, and potential fraud calls, even from unknown numbers. Some compatible Galaxy phones with One UI 8.5 or higher also feature a real-time Scam detection that analyzes calls for scam patterns and alerts the user. Availability of these features can vary by model, carrier, and software version.

To check scam and spam protection on a Samsung Galaxy:

1. Open the Samsung Phone app.
2. Tap the three vertical dots in the upper-right corner.
3. Tap Settings.
4. Tap Caller ID and spam protection.
5. Ensure the main switch is on.
6. Turn on Block spam and scam calls, choosing between blocking all or only high-risk calls.

Google Pixel phones include a Scam Detection feature that analyzes phone conversations in real time, warning users of patterns commonly associated with fraud. Newer models like the Pixel 9 and later utilize Gemini Nano on-device for this purpose. This feature is available on eligible Pixel 6 and later devices in the U.S., though it cannot detect every scam.

To enable call Scam Detection on Pixel:

1. Open the Phone app.
2. Tap the menu in the upper-right corner.
3. Tap Settings.
4. Tap Scam Detection.
5. Turn on Scam Detection.

Pixel phones also offer Scam Detection for chat messages, which analyzes notifications from supported apps and warns users of suspicious content. This feature is on by default in the U.S. and other select countries. It can also function with Gboard in certain messaging apps to warn users as they type responses.

To check message Scam Detection on Pixel:

1. Open Settings.
2. Tap Security & privacy.
3. Tap More security & privacy.
4. Tap Scam Detection.
5. Ensure Message scams is turned on.

Different Approaches, Common Goal

Apple's Impersonation Risk Detection focuses on user manipulation within apps, while Pixel and Samsung Galaxy offer protections for calls and messages. This multi-faceted approach can be beneficial, as scams can escalate across different communication channels.

When a phone warns of a possible scam, users are advised to stop, verify the situation independently, and avoid following the instructions of the potential scammer. This includes hanging up on suspicious calls and contacting the purported entity through official channels. It is also important to remember that a lack of warning does not guarantee a call or message is legitimate.

While these features add a significant layer of security, experts caution against relying on them as the sole protection. Scammers continually adapt their methods, using tactics like caller ID spoofing and personal information to enhance credibility. Vigilance, such as slowing down when asked for sensitive information and recognizing demands for money transfers to