The hardest frauds to stop are the ones the victim authorises. Apple's new iOS 27 framework watches the behaviour, not just the password.