Filed as FB_______. Related to thread 841386 ("iOS 27: Malicious link blocked") and FB25102183, but this case involves no link at all. The user pastes the code into the Phone keypad themselves.
Setup: iPhone 17 Pro Max, iOS 27.2, Verizon (forwarding code *72 + 10-digit number; GSM carriers use **21* + number + #).
What our app does: our customers forward their own cell to their own business number on our service. The app never opens a tel: link, never dials and never uses Shortcuts. It shows the carrier's forwarding code, copies it to the pasteboard only when the user taps "Copy code", and guides them to paste it into Phone > Keypad and tap call themselves. That normally works.
Steps to reproduce:
- Copy a forwarding code (e.g.
*72+ a 10-digit number). It can come from any app; Notes reproduces it. - Open Phone > Keypad and paste it. Don't tap call.
- Leave the Phone app.
- Come back. The keypad is empty, so tap the green call button. Redial fills the code back in.
- Tap call. Result: "Call Forwarding Link Blocked", with only OK and Learn More.
- From then on, clearing the field and pasting the same code again is also blocked, every time, until the Phone app is force-quit from the app switcher.
- After a force-quit, paste + call works again.
To be clear: a normal paste works every time. Paste the code and tap call right away, without leaving the Phone app, and it dials and the carrier confirms forwarding. Typing the code by hand also always works. Only the leave-and-redial path triggers the block, and it then sticks until force-quit.
Expected: consistent behavior. A code the user pastes or types into the keypad and dials themselves should not be treated as a "link" depending on whether redial filled the field, and the block should not persist across fresh pastes.
Questions for DTS:
- Is a user pasting a forwarding code into the keypad and dialing it themselves a supported flow going forward, or should apps tell iPhone users to type these codes by hand?
- Is there, or is there planned, a supported way for an app to ask iOS to set up call forwarding to a given number, with the user approving it in system UI? Legitimate services where customers forward their own number to their own account currently have no path that doesn't look like the scam pattern this protection targets.
Happy to provide a sysdiagnose or a screen recording.