Fraudsters are increasingly relying on targeted attacks to steal money, access data or other valuable resources. The term “social engineering” has become commonplace: Instead of exploiting vulnerabilities in software, attackers persuade users to hand over information or transfer money. However, software developers cannot distinguish whether users carry out a transaction of their own free will or are coerced into doing so. At WWDC, Apple introduced a new framework called “Trust Insights” that helps identify suspicious behavior patterns. The Swift API intended for iOS 27 is intended to help detect suspicious behavior, such as tech support scams, faking interaction with investigative authorities or faking emergency situations involving family members. App developers can integrate trust insights detection into their apps. They then need to specify a category in a function call, such as whether the user interaction is about money, resources, credentials, communication, or something else. The answer comes after a few seconds from Apple servers with a rough probability estimate, for example whether a user is being instructed by alleged technical support.
With data protection and can be switched off
The framework is based on the knowledge that the group has previously collected in its own applications. The Trust Insights detection model emerged from attempted fraud, probably involving Apple accounts and credit cards stored in Apple Wallet. Apple emphasized in the session that the analysis is based on behavior, not content: the timing of user input, context and interaction patterns are analyzed. What exactly is entered remains hidden from the Trust Insights API. Users also have the choice of whether apps are allowed to carry out this pattern recognition and can deactivate it in the settings.
Feedback for further development
Apple expects something in return for this service. An app with Trust Insights API is required to report directly to Apple’s server how the app reacted to the specific case. Apple wants to know whether the app imposed a delay on the user or canceled the transaction – or whether it came to the conclusion that everything was correct. This feedback is necessary in order not to be restricted in the number of permitted requests. Additionally, Apple requests final notification of a case via a server-to-server API – even months after the original interaction, if necessary. However, this is voluntary.
Not a blank ticket
It is pointed out several times in the lecture that app developers should not blindly rely on the Trust Insight API evaluations, but rather use them as a reference point in a multifactorial evaluation. In the future, the underlying model will be revised and newer versions offered; Apple also recommends that developers prepare to regularly test newer models and, if necessary, integrate them into their app.
