Two-factor authentication stops a stranger from logging into your bank account. It does nothing when a scammer on the phone convinces you to log in and send the money yourself. Apple’s answer in iOS 27 is Impersonation Risk Detection, a privacy setting that lets supported apps request a quick risk check before you complete a payment or account change. Your iPhone analyzes signals such as timing and interaction patterns on the device, then gives the app a simple rating without sharing the data behind it. It’s off by default, and turning it on takes a few taps.

The tool protects against active social engineering scams , which try to scoop up money or account information by posing as trusted entities, such as your bank or a government agency. Impersonation Risk Detection analyzes factors such as interaction patterns, timing and context to indicate one of three risk levels:

Unknown: There’s no evidence or detection of suspicious activity.…