Apple’s new security feature for iPhone and iPad can protect you from scammers

Apple delivered a cool new security feature with iOS 27 and iPadOS 27, although it didn’t make headlines. Called Identity Theft Risk Detection, it analyzes device behavior in real time to flag active social engineering scams, the kind that trick you into giving up access yourself, even when your passwords and two-factor codes are working as expected.

It works entirely on the device, so Apple never sees your photos, texts, or other personal content. When a supported application requests a risk assessment, it receives a label that does not contain any of the data underlying that determination. This is an optional feature, making it a complementary tool to any other steps you take to be safe online.

Security features like two-factor authentication are great, but identity theft risk detection is designed for a different kind of danger. Social engineering scams don’t penetrate your defenses, but rather convince you to open the door yourself. From old callers pretending to be your bank to text messages that sound like a fraud alert, they all create a sense of urgency that attempts to bypass your protections. When you open the door yourself, there is no two-factor code that can signal the problem. But this feature (hopefully) can.

Identity theft risk detection helps detect the signs of a scam when it happens. When you take a sensitive action, such as making a payment or changing account security details, a supported application may request a real-time risk assessment. Your phone generates this assessment by analyzing interaction patterns, timing, context, and basic sensor data, all of which run on the device. Based on this analysis, the system assigns one of three risk levels:

• Unknown: The system has not detected any suspicious activity (although this does not mean it is safe to continue).

• AVERAGE: The tool detected signs of suspicious activity.

• High: Major signs of suspicious activity have been detected.

An attacker posing as a bank representative or government official can pressure people into approving questionable transactions or sending their passwords, which can be even more convincing with AI. Apple’s new tool fills a gap by detecting suspicious behavior at the times fraudsters count on. However, the decision on what to do is up to the app developer. Depending on the risk level returned, the app may ask you to verify your identity, impose a short waiting period, or display a warning.

If you want to enable this feature for yourself or your loved ones, follow these steps on your iPhone or iPad:

1. Go to Settings > Privacy & Security.

2. Scroll to Identity theft risk detection and activate Share with app developers.

In the same menu as above, you will be able to see which applications have requested a risk assessment and why, and adjust their access. Apple also mentions that if someone contacts you and insists that you turn this feature off, you should treat it as a red flag. This is exactly why disabling the feature may take up to 24 hours to take effect.

This feature only works with apps designed to support it, and Apple hasn’t released a list of them yet. Hopefully many will internalize this over time. Identity theft risk detection is a logical extension of Apple’s focus on security, as demonstrated by Safari’s anti-tracking tools. It addresses a blind spot that no browser setting or password manager can fully address: manipulation.