Inside iOS 27's "Being Coached" Signal: The Specific Mechanism Behind Impersonation Risk Detection

Our earlier piece on iOS 27's Impersonation Risk Detection covered what the feature is in broad strokes — a setting most people will never find, built on a framework Apple calls Trust Insights. What it didn't get into is the specific mechanism Apple actually built to catch someone in the middle of a live scam call. That mechanism has a name, a published description, and it's more precisely targeted than "detects scams" suggests.

What "Being Coached" Means, Technically

Apple's own developer documentation describes a structure called IsLikelyBeingCoachedInsight, part of the Trust Insights framework shipping with iOS 27. Its stated purpose, quoted directly from Apple's documentation: "An insight to request to examine indications that someone may be actively coaching a person to perform actions." The documentation goes further on when it's meant to be used — "operations where it's possible that someone may be in the process of being defrauded (such as transfers to new counterparties)" — and names the kind of response an app might trigger off it: what Apple calls "step ups" or "blocks," meaning extra verification or an outright hold on the action.

Apple includes its own honest caveat directly in the documentation: "it's important to be aware that coaching may not necessarily be malicious." Someone talking a family member through a transfer over the phone looks, on paper, like the same pattern as a scammer doing it — the signal flags the behaviour, not the intent.

How This Actually Catches a Live Phone Scam

This is a precise match for the most damaging bank-impersonation pattern Australians are currently losing money to. Scamwatch's own alert on bank impersonation scams describes the pattern plainly: a caller claims to be from the bank's fraud team, cites a compromised account or suspicious transaction to create urgency, and tells the victim to transfer their money to a different account "to keep it safe" or for "further investigation" — while staying on the phone with them the whole time. Scamwatch reports an average loss of $22,000 across these scams, with more than 90 reports between $40,000 and $800,000.

That's exactly the shape of the thing IsLikelyBeingCoachedInsight is built to notice: a transfer, to a new counterparty, happening while something about the person's behaviour suggests they're being walked through it by someone else. An app that checks this signal before processing the transfer can add a step-up verification or a delay at precisely the moment that matters — not after the money's already gone.

What It Can't Tell

The signal is a behavioural flag, not a fraud verdict, and it can't tell the difference between a scammer on the line and a genuinely helpful relative doing the same thing. It also only does anything if the app making the transfer actually requests the insight and chooses to act on it — the same adoption gap we flagged in our earlier piece applies here specifically to this signal, not just to Impersonation Risk Detection broadly. A banking app that hasn't built this check in gets nothing extra from a user having the setting turned on.

Getting Help

Knowing the specific mechanism doesn't change what you need to do about it — turning the setting on, as covered in our general guide to iOS 27's Impersonation Risk Detection, is still the only action required on your end. The rest depends on which apps on the phone have actually built against it. Our Small Business IT Support service can help make sure the phones handling your business's banking are set up with every available protection switched on, not just the obvious ones.