Impersonation Risk Detection in iOS 27 is an optional anti-scam feature that lets supported third-party apps request a limited risk assessment when you take a sensitive action, such as making a payment or changing important account details. With Share with App Developers turned on, the app receives a risk level rather than your call history, email content or other underlying personal data. Most people can leave it enabled as an extra safeguard, but it is not a guarantee that an action is safe and it works only in apps that support the feature.
What Share with App Developers enables
The name of this setting can sound broader than it is. It does not give every developer open access to your iPhone activity. Instead, it allows a compatible app to request a risk assessment at selected moments when a person might be acting under pressure from an impersonator or scammer.
For example, an app might request an assessment when you make a payment, sign in, change a password or other critical account information, use a costly online service, or take another action the developer considers sensitive. Apple describes the feature as protection against active social-engineering scams, in which someone posing as a bank, government agency or trusted person pressures you into completing an otherwise legitimate action.
The assessment returns one of three risk levels:
- Unknown: No evidence of suspicious activity was detected. This does not confirm that the action is safe.
- Medium: Some signs of suspicious activity were detected.
- High: Significant signs of suspicious activity were detected.
The app decides what happens next. Depending on its own security procedures, it might show a warning, ask you to verify your identity, add a delay or apply additional checks. It may also use the result without showing a visible message. Apple does not control the action the app takes.
A risk level is only one security signal. In particular, an Unknown result does not mean that a payment, account change or other action has been verified as legitimate. Developers are not permitted to rely on Trust Insights data as their sole basis for deciding whether activity is legitimate.
How to turn it on and manage app access
Impersonation Risk Detection is available from iOS 27 and iPadOS 27. On an iPhone, follow these steps:
- Open Settings.
- Tap Privacy & Security.
- Scroll down and tap Impersonation Risk Detection.
- Turn on Share with App Developers.
You may need to sign in to the App Store with your Apple Account before you can turn on the setting. If you do not see the menu, check that your device is using iOS 27 or later. The feature is also available on supported iPads running iPadOS 27 or later.
The same settings page lets you review and manage requests from individual apps:
- Under Recent Activity, see which apps have requested a risk assessment.
- Under Reasons for Access, review the type of action that prompted each request.
- Tap an app to turn off its access without disabling the feature for every supported app.
Changes to the main setting and changes to an individual app’s access may take up to 24 hours to take effect. Apple uses this delay as a safeguard because a scammer might try to coach someone into disabling the protection during an active scam. Do not assume that a request will be blocked immediately after you turn a setting off.
What information is used and what apps receive
Apple says the feature analyzes information about your device and Apple Account to detect possible signs of an active scam. The on-device part of the assessment can consider interaction patterns, timing, context and basic sensor data. Examples Apple gives include whether screen sharing is active and the approximate number of recent phone calls or emails received.
Apple says it does not analyze the contents of your Photos, Messages or Mail for this feature. It may use limited information about device-use patterns, but it does not read the content of a message or email to decide whether a particular conversation is fraudulent.
The device creates an on-device assessment, which is sent to Apple without the underlying device data. Apple combines that assessment with relevant Apple Account activity, such as recent App Store downloads and App Store content purchases, to generate the signals sent to the requesting app.
The key privacy limits are as follows:
- The requesting app receives the risk level, not the underlying data. It does not receive your call records, email contents, sensor readings, interaction history or Apple Account activity through this feature.
- Apple does not receive the underlying on-device information used to create the device assessment.
- Apple learns the category of in-app action involved in the request, such as an account sign-in or payment transaction, but says it does not learn which app made the request or the content of your in-app activity.
- The requesting app reports how it used the signal, or whether it did not use it, so Apple can provide and improve the feature.
An app still knows what you do within that app under its own privacy policy. For example, a banking app necessarily knows the transfer you ask it to make. The limitation is that Impersonation Risk Detection does not provide that app with the underlying device and Apple Account signals used to produce its risk level.
Why you may never see a warning
Turning on Share with App Developers does not create a systemwide scam scanner that monitors every app or displays an iPhone alert whenever activity seems suspicious. A developer must adopt Apple’s Trust Insights framework, obtain the required entitlement and build the assessment into appropriate points in its app.
As a result, you may not see a warning for several reasons:
- None of your installed apps supports Impersonation Risk Detection.
- A supported app requests an assessment only for particular actions, such as payments or account changes.
- The app receives an Unknown risk level and does not need to add friction.
- The app uses the result as part of an internal security process rather than displaying a message.
- An assessment cannot be returned, such as when internet connectivity is unavailable, and the app follows its usual security process instead.
The Trust Insights framework requires internet connectivity to return results. A compatible app must also request your authorization before it can generate evaluations. The Recent Activity section in Settings is therefore a more reliable way to check whether the feature has been used than waiting for a warning. An empty list can simply mean that no compatible app has requested an assessment.
Should you enable Impersonation Risk Detection?
For most users, leaving Share with App Developers enabled is reasonable. Supported apps receive a limited risk level rather than the underlying device data, and the feature can add helpful checks when someone may be pressuring you to make a payment or weaken account security.
You may prefer to leave it off, or disable it for selected apps, if you want to limit optional processing that combines an on-device assessment with Apple Account activity. The trade-off is that compatible apps will not receive this additional risk signal when you take sensitive actions.
Keep using normal scam precautions either way. Be wary of unexpected demands for money, remote access, verification codes or urgent account changes. An Unknown result is not proof that an action is safe, and apps that do not support the feature cannot use it. If someone tells you to turn off Impersonation Risk Detection, end the interaction and contact the organisation through a phone number, website or app you independently know is genuine.
