Apple's iOS 27 Can Now Tell You When You're Being Scammed, Mid-Call
Introduction
There is a particular kind of fraud that security engineers have struggled with for years, precisely because it defeats every technical safeguard by design. It is the social engineering scam, where a caller poses as your bank's department, your tax office, or a relative in trouble, and walks you, step by step, into making a payment or changing your own account details. Two-factor authentication does not stop this. Strong passwords do not stop it. The account holder is doing everything correctly, except they have been persuaded to do the wrong thing by someone skilled at sounding legitimate. With iOS 27 and iPadOS 27, released in September 2026, Apple has built a feature aimed specifically at that gap, called Impersonation Risk Detection.
What the feature actually does
The mechanism is narrower and more specific than it might first sound. Impersonation Risk Detection does not run continuously in the background scanning for scam calls the way a caller ID app might. Instead, it activates only when a supported app, not Apple's own apps necessarily, but any third party app that chooses to integrate it, requests a real time risk assessment at the exact moment a user attempts a sensitive action. Apple's own examples are specific: making a payment, changing a password, or modifying other critical account security information.
At that moment, the operating system runs an on-device analysis built on what Apple calls its Trust Insights framework. It draws on device use patterns, including the approximate number of recent phone calls and emails, Apple Account information such as app download and purchase history, and what Apple describes as interaction patterns, timing, context and basic sensor data. Crucially, Apple has been explicit that the system does not read the contents of Photos, Messages or Mail, and it does not examine the actual point of intrusion, meaning it cannot tell you whether the phone call you are currently on is itself fraudulent. What it is assessing, instead, is whether the pattern of behaviour surrounding this specific sensitive action looks statistically consistent with how a genuine user behaves, or with the pressured, rushed, coached pattern typical of someone being actively scammed.
The output is deliberately minimal. The requesting app receives only one of three labels, unknown, medium or high risk, never the underlying data that produced it. An "unknown" rating means no suspicious signs were detected, though Apple is careful to note this does not confirm the action is actually safe, only that nothing suspicious surfaced. Apple itself never sees the underlying device data used to generate the assessment either, though it does learn what type of action triggered the request in the first place. What the app then does with that risk label, whether to add a waiting period, prompt identity verification, or display an outright warning, is left entirely to the app's own design, not dictated by Apple.
Why the defaults and the fine print matter
Two details in how Apple shipped this feature are worth paying close attention to, because they reveal a lot about the threat model Apple was actually designing against. First, the feature is off by default. Users must manually navigate to Settings, then Privacy & Security, then Impersonation Risk Detection, and toggle on Share with App Developers, often requiring an Apple Account sign-in to activate. Second, and more tellingly, Apple built in a mandatory 24 hour delay before the toggle, once enabled, can actually be switched off. Apple's own guidance states plainly that if someone contacts you and insists you turn this feature off, treat that as a red flag. That is not a generic privacy disclaimer. It is Apple directly anticipating that scammers, once this feature becomes widely known, will start coaching victims to disable it mid-call, and designing a specific friction point to blunt exactly that manipulation.
Apps that have requested an assessment appear under a Recent Activity log, where users can review the specific actions that triggered each request and revoke access app by app, through a section Apple labels Reasons for Access. As of launch, Apple has not published a list of which apps actually support the feature, meaning its real world usefulness depends entirely on third party developers choosing to integrate it, something Apple cannot mandate.
How this compares to what Google has shipped earlier
Apple is not the first to market here, and the framing in early coverage of this feature, "it was just a matter of time," reflects that fairly accurately. Google began rolling out Scam Detection on Pixel phones in beta in late 2024, expanding it through 2025 using its on-device Gemini Nano model to analyse both phone calls and text messages in real time. The approaches differ in a meaningful way, though. Google's feature listens to an entire live conversation for scam-like conversational patterns, playing an audible beep at the start of a monitored call so both parties know AI analysis is active, and can interrupt mid-call with a warning. Apple's feature does not listen to anything resembling the call itself; it evaluates behavioural and account signals around a specific sensitive action a user is about to take, regardless of whether that action was prompted by a phone call, a text, or an email. Google's model is built around catching the scam as it happens in conversation; Apple's is built around catching the moment the user is about to act, irrespective of the channel that pressured them there. Both are opt-in or off by default, and both emphasise on-device processing and limited data sharing, reflecting a shared industry recognition that scam detection tools built on reading private conversations need unusually strong privacy guarantees to earn user trust.
Why this matters well beyond the US
Google has already signalled that it sees markets like India as a genuine proving ground for this category of tool, having launched Pixel-based scam detection there in November 2025 specifically citing the scale of digital fraud losses in the country, alongside partnerships with Indian financial apps including Google Pay, Paytm and Navi to warn users during risky screen-sharing sessions, a common vector in Indian banking fraud. That context matters for Apple's rollout too. Social engineering scams impersonating banks, government tax departments and law enforcement are a dominant and rapidly growing fraud category across much of Asia, and a feature that specifically targets the moment someone is being walked through a fraudulent payment, rather than relying on the victim recognising the scam themselves, addresses exactly the mechanism that most existing fraud prevention tools miss.
The honest limitation
Apple has been careful, in its own language, to frame this as a supplementary safeguard rather than a complete solution to telecom and online fraud, and that caution lines up with what the broader behavioural analytics industry has already learned the hard way. The feature depends entirely on third party app adoption that has not yet been detailed, it is switched off by default so most users will never encounter it without deliberately enabling it, and an "unknown" risk rating explicitly does not mean an action is safe, only that nothing suspicious happened to surface.
The deeper issue is one every company working on behavioural fraud detection has run into before Apple did: these systems are only as reliable as the baseline of "normal" behaviour they are measuring against, and that baseline is not stable across every type of user. Industry data on behavioural biometrics, the broader category of technology Apple's system belongs to, puts typical false positive rates for flagging new device, location, or timing combinations in the range of 15 to 25 percent before careful tuning, and practitioners in the field note that elderly users in particular tend to show higher variance in their interaction patterns, which makes them statistically harder for these models to read correctly, not easier, despite being exactly the population most targeted by impersonation scams in the first place. The risk is not hypothetical or confined to finance. In eldercare technology more broadly, a documented case from a California pilot programme saw a fall detection system switched off entirely after it generated so many false alarms that it triggered repeated, unwanted social service visits to an older adult's home, a clear illustration of what happens when a protective automated system cannot adequately account for the exact population it was built to protect.
Apple has not published performance data on how Impersonation Risk Detection behaves across these edge cases, new phones, irregular usage patterns, older users less familiar with typical app behaviour, and that silence is worth noting rather than assuming away. What Impersonation Risk Detection represents is not a solved problem, but a genuine, technically serious first attempt by a major platform to intervene at the exact moment social engineering scams succeed, the point of action, rather than relying on users to have correctly identified the deception several steps earlier. Whether it meaningfully reduces fraud losses at scale will depend less on the underlying design, which appears carefully thought through, and more on two things outside Apple's direct control: how many developers actually build it into the apps people use for banking and account security, and how well the system holds up for exactly the users who need it most.
References
- Help Net Security, "Apple's new iOS 27 feature looks for signs you're being scammed." https://www.helpnetsecurity.com/2026/09/24/apple-ios-27-impersonation-risk-detection/
- 9to5Mac, "iOS 27 adds scam-prevention feature to iPhone, here's how to enable it." https://9to5mac.com/2026/09/16/ios-27-adds-scam-prevention-feature-to-iphone-heres-how-to-enable-it/
- 9to5Mac, "Security Bite: iOS 27 now lets apps ask your iPhone if you're being scammed." https://9to5mac.com/2026/09/21/security-bite-ios-27-now-lets-apps-ask-your-iphone-if-youre-being-scammed/
- Engadget, "Apple's new iPhone and iPad security feature can protect you from scammers." https://www.engadget.com/2271157/apple-iphone-ipad-impersonator-risk-detection-new-security-feature/
- gHacks Tech News, "iOS 27 Adds Impersonation Risk Detection to Help Protect Against Social Engineering Scams." https://www.ghacks.net/2026/09/21/ios-27-adds-impersonation-risk-detection-to-help-protect-against-social-engineering-scams/
- BigGo Finance, "Apple Rolls Out On-Device Scam Detection in iOS 27 Ahead of High-Risk Transactions." https://finance.biggo.com/news/89a0ae92-1603-4ac9-aef9-b8b466e6ac40
- MacObserver, "iOS 27 Impersonation Risk Detection: How Apple's anti-scam setting works." https://www.macobserver.com/news/ios-27-impersonation-risk-detection-anti-scam-setting/
- Google Blog, "New AI-Powered Scam Detection Features to Help Protect You on Android." https://blog.google/security/new-ai-powered-scam-detection-features/
- Digital Trends, "Google Pixel 9 is getting a scam detection upgrade you'll want on your phone." https://www.digitaltrends.com/phones/google-pixel-scam-detection-gemini-nano-ai-calls-messages-safety/
- Gulf News, "Google ramps up AI scam protection in India." https://gulfnews.com/technology/media/google-ramps-up-ai-scam-protection-in-india-1.500355149
Related Blogs
Executive Summary
A video is being widely shared on social media linking it to a Muharram procession in India. The video shows a person engulfed in flames, with users claiming that an individual was deliberately set on fire during a Muharram procession in India. Several social media users are circulating the clip with communal claims. CyberPeace Research Wing research found that the viral claim is misleading. The video does not show any incident of a person being deliberately burned during a Muharram procession. In reality, it is from Deoria, Uttar Pradesh, where a performer sustained burn injuries while performing stunts during a Muharram procession.
Claim:
On X (formerly Twitter), a user posted the viral video on 3 June 2026, claiming: “Not Bangladesh, this is India where a person is being burned alive during a Muharram procession.” The post link, archive link, and screenshots are provided below. https://x.com/singh_kikki/status/2070753631167541586 , https://archive.ph/vP3bZ
Fact Check:
For verification, we extracted multiple keyframes from the video and conducted a reverse image search using Google Lens. During the search, we found the same video published on the Public app on 27 June 2026. According to the report, the incident took place on Malviya Road in Deoria city, Uttar Pradesh, during a Muharram procession, where a member of the 5-Star Club akhara, Saddam (24), a resident of Bans Deoria, suffered burn injuries while performing stunts involving fire. The report further stated that members of the akhara immediately rescued him and arranged first aid. Police confirmed that his condition is stable and that the incident was accidental. No other untoward incident was reported, and all Muharram processions were conducted peacefully. A statement by Circle Officer (City), Sanjay Kumar Reddy, was also included in the report. https://public.app/video/sp_zh7dywam0a2pb
In our subsequent research, we found a report published on Dainik Bhaskar's website with the same claim. A link and screenshot of the post are provided below. https://www.bhaskar.com/amp/local/uttar-pradesh/deoria/news/deoria-youth-burns-muharram-procession-stunt-138296624.html
Finally, we also found an official post from the Deoria Police X handle confirming the incident. The police stated that a performer from the 5-Star Club akhara was injured while performing stunts on Malviya Road and was immediately given first aid. His condition is stable, and no other incident occurred. https://x.com/DeoriaPolice/status/2070521290864377982
Conclusion:
The research clearly found that the viral video does not show a person being deliberately burned during a Muharram procession. The footage is from Deoria, Uttar Pradesh, where a performer was accidentally injured during a fire stunt.
Introduction
After the tragic bomb blast at RedFort on November 10, 2025, there is a trail of misinformation and false narratives spread rapidly across social media platforms, messaging and news channels. It can not only unfold into a public misunderstanding but can also incite panic, communal tensions and endanger lives. To prevent all of these from happening, we, as responsible citizens, can play a critical role by verifying information before sharing it with friends, family, or colleagues. This article provides guidance on practical, evidence-based strategies to navigate the information landscape and protect yourself and your community from the harm caused by misinformation and disinformation.
Digital Scams in the Aftermath of the Blast
Cybercriminals increased their activity in the hours after the Red Fort explosion, using the country’s sorrow as a chance to take advantage of fear.
Numerous allegations surfaced of residents receiving threatening calls that falsely claimed they were “digitally arrested” or that their phones, bank accounts, or Aadhaar were being “seized for investigation”, accusing them of being involved in the explosion. These fictitious intimidation calls sent innocent people into worry, anxiety, and doubt spirals.
The pattern is common after major national crises:
- Fear rises.
- People seek urgent answers.
- Cybercriminals exploit the confusion.
Knowing this makes it easier for us to remain watchful. No law enforcement organisation uses phone conversations, WhatsApp communications, or threats of “digital detention” to make arrests or conduct investigations.
Verify breaking news from trusted official channels
Whenever a crisis like bomb blasts occurs, people look for information on social media, news channels, and YouTube channels to stay fully informed about the situation. This is a very chaotic moment, and due to the lack of government verification of the initial information, false news spread rapidly.
Where to seek verified information:
a. Press Information Bureau (PIB): The official government news agency that, from time to time, clarifies viral news.
b. Delhi Police Official Channels: Check social media handles of Delhi Police.
c. Ministry of Home Affairs (MHA): MHA is responsible for internal security, and gives information about this information through official press releases and notifications.
d. Major Credible news outlets: Some news channels can be trusted with news, as they typically verify information before publishing, like The Hindu, Indian Express.
What to do:
Cross-check every unverified social media post and news that you come across from credible news channels and official government press releases.
Verify Images and videos using reverse search tools
Recently, many social media handles have been sharing old photos of different bomb blasts from Ukraine, Israel, and Palestine in the name of the Red Fort blasts. While it can create a false narrative, the same should be verified before sharing.
Reliable fact-checking resources and how to use them.
Every country has dedicated fact-checking organisations that systematically verify viral claims.
Fact-checking organisations based in India:
a. PIB Fact Check (https://factcheck.pib.gov.in/ )
· It is the official fact-checking unit of the PIB, which focuses on demystifying government-related misinformation.
· email: socialmedia@pib.gov.in
· Telegram: http://t.me/PIB_FactCheck
· Follow it on: Twitter (@PIBFactCheck), Facebook, Instagram, Telegram and WhatsApp.
How to use these resources:
· Whenever you come across any viral post, use exact keywords or quotes to find those on these resources.
· Look for the verdict (true, false, misleading), then share the verified fact-checks with your network to debunk false narratives.
Practice Digital Hygiene and Be Cautious When Sharing
Digital hygiene refers to the practices and habits individuals adopt to maintain a healthy and secure digital lifestyle. Simple digital practices can restrict the spread of misinformation. A vigilant individual can reduce the spread of misinformation. It can be done by below steps
i. Check URLs and Links: We can verify the URLs and links of any news and websites using different tools to check the credibility of any news
ii. How to Evaluate the Trustworthiness of Sources:
· Verify if the account sharing the information has a blue checkmark on most platforms.
· Examine the account's background, whether it is a recognised media source, an official government profile, or a newly created anonymous account?
· Approach posts featuring intense emotional language ("URGENT!", "SHOCKING!", "MUST SHARE!") with scepticism.
· Refrain from posting screenshots of tweets or posts while providing a link to the source, allowing others to confirm its validity.
iii. Before You Distribute:
· Question yourself: "Am I certain this is accurate based on a reliable source?"
· Avoid the temptation to share breaking news immediately; hold off until it has been confirmed by government sources.
· If you're uncertain, include a comment such as "I haven't confirmed this yet; please consult reliable sources" instead of sharing unverified information.
· Reflect on the consequences, as it might lead to panic, provoke communal violence, or damage an individual's reputation
6. How to report misinformation to platforms and authorities?
While it is important to verify news before sharing it to prevent fake news, it is also important to report it to reduce misinformation and the violence caused due to it. On social media like Facebook, Instagram, Twitter/X, WhatsApp, and Telegram, anyone can report the same on the platform.
Reporting to the Government Authorities:
a. PIB Fact Check WhatsApp (+91 8799711259):
Send Screenshots or texts of suspected government-related misinformation for verification, and then an automated acknowledgement is generated.
b. Delhi Police Cyber Crime Unit
Cyber Crimes such as Email Frauds, Social Media Crimes, Mobile App-related crimes, Business Email Compromise, Data Theft, Ransomware, Net Banking/ ATM Frauds and fake calls frauds, insurance frauds, lottery scam, bitcoin, cheating scams, online transactions frauds can be reported to the Delhi Police Cyber Crime Unit.
7. Quick checklist: What to do When You See Breaking News
· Wait before sharing any breaking news.
· Go through official channels like PIB and other official channels like MHA.
· If not available there, then cross-reference it from 2-3 credible news sources for the same information.
· Check timestamps and metadata, and compare metadata dates with claims about when events occurred.
· In case you find any information, news or any social media posts as misleading, then report the same.
CyberPeace Resolves: Pause. Reflect. Then Respond
Misinformation becomes the infection that spreads the fastest when people are confused and afraid. Every citizen is urged by CyberPeace to remain composed, stand tall, and not panic, particularly in times of national emergency.
Prior to experiencing an emotional response to any concerning call, message, or widely shared news:
Pause. Reflect. Acknowledge.
- Pause before sharing or responding.
- Reflect on whether the information is from a credible source.
- Acknowledge what you know—and what is just rumour.
CyberPeace is still dedicated to helping people and communities deal with online dangers, safeguard mental health, and dispel false information with clarity and truth.
Executive Summary
A viral video allegedly featuring cricketer Virat Kohli endorsing a betting app named ‘Aviator’ is being shared widely across the social platform. CyberPeace Research Team’s Investigations revealed that the same has been made using the deepfake technology. In the viral video, we found some potential anomalies that can be said to have been created using Synthetic Media, also no genuine celebrity endorsements for the app exist, we have also previously debunked such Deep Fake videos of cricketer Virat Kohli regarding the misuse of deep fake technology. The spread of such content underscores the need for social media platforms to implement robust measures to combat online scams and misinformation.
Claims:
The claim made is that a video circulating on social media depicts Indian cricketer Virat Kohli endorsing a betting app called "Aviator." The video features an Indian News channel named India TV, where the journalist reportedly endorses the betting app followed by Virat Kohli's experience with the betting app.
Fact Check:
Upon receiving the news, we thoroughly watched the video and found some featured anomalies that are usually found in regular deep fake videos such as the lip sync of the journalist is not proper, and if we see it carefully the lips do not match with the audio that we can hear in the Video. It’s the same case when Virat Kohli Speaks in the video.
We then divided the video into keyframes and reverse searched one of the frames from the Kohli’s part, we found a video similar to the one spread, where we could see Virat Kohli wearing the same brown jacket in that video, uploaded on his verified Instagram handle which is an ad promotion in collaboration with American Tourister.
After going through the entire video, it is evident that Virat Kohli is not endorsing any betting app, rather he is talking about an ad promotion collaborating with American Tourister.
We then did some keyword searches to see if India TV had published any news as claimed in the Viral Video, but we didn’t find any credible source.
Therefore, upon noticing the major anomalies in the video and doing further analysis found that the video was created using Synthetic Media, it's a fake and misleading one.
Conclusion:
The video of Virat Kohli promoting a betting app is fake and does not actually feature the celebrity endorsing the app. This brings up many concerns regarding how Artificial Intelligence is being used for fraudulent activities. Social media platforms need to take action against the spread of fake videos like these.
Claim: Video surfacing on social media shows Indian cricket star Virat Kohli promoting a betting application known as "Aviator."
Claimed on: Facebook
Fact Check: Fake & Misleading
