Apple's iOS 27 gives opted-in apps an on-device scam risk level to flag possible impersonation

The scam this aims at is the authorized payment. Someone calls claiming to be the bank's fraud desk, the customer moves the money themselves, and every control that checks identity sees the right person on the right device. Apple wrote: "Traditional security measures like two-factor authentication can't always detect this kind of scam. That's because you're taking the action, even though you've been tricked or pressured." ^[3]

An app can ask for an assessment when the customer makes a payment, changes a password, or modifies other critical account-security information ^[9]. It gets back one of three levels ^[10]. The scoring runs on the device ^[6]. The app sees the level and nothing underneath it ^[7]. Apple says it does not receive the device data behind the level, though it does learn the type of action the user attempted when the request came in ^[7].

Two of the three answers tell a fraud team that something was detected ^[1]. The third, "unknown", means no evidence of suspicious activity was found, and Apple states that it is not a confirmation the action is safe ^[10]. A queue rule can hold or step up on medium and high. It has no basis to release a payment faster on unknown. What happens next is the app's call: identity verification, a waiting period, or a warning ^[8].

The input list is the part a privacy reviewer will question. Apple's on-device disclosure cites device-use patterns, including the approximate number of phone calls and emails sent or received, and Apple Account information such as app downloads and content purchases ^[5]. The analysis may also include interaction patterns, timing, context and basic sensor data ^[6]. Apple says it does not analyze the contents of Photos, Messages or Mail ^[6]. The audit trail sits on the handset: Recent Activity lists the apps that asked, Reasons for Access shows which actions prompted them, and access can be switched off for individual apps ^[12].

Enrollment is a customer action. Share with App Developers is under Settings > Privacy & Security, and Apple notes the user may need to sign in to the App Store with an Apple Account to turn it on ^[11]. Changes to the main setting or to an app's access may take up to 24 hours to take effect ^[13]. So a bank cannot talk a caller through enabling the feature and then use the signal on that same call. A scammer coaching a victim to switch it off runs into the same delay.

Apple did not name any app, bank or payments provider that requests these assessments ^[14].