AI-Assisted Phishing: Why Emails Look Better and What to Check Instead
For years, people were told to look for spelling mistakes and awkward grammar when judging a suspicious email. That advice has aged badly. Text-generation tools can produce fluent, well-formatted messages in many languages, so the clumsy writing that once gave scammers away is less reliable as a clue. Phishing has not changed in purpose; it has simply become more polished.
What stays the same
A phishing message still wants one of a few things: your login details, a payment, a downloaded file or a reply that starts a longer conversation. The wrapper may be better written, but the underlying request is usually out of character for the supposed sender. That mismatch is where careful readers can still catch it.
What has changed
- Personalisation at scale. Messages can mention your employer, a recent event or a real colleague, using information scraped from public profiles.
- Tone matching. A fraudster can imitate the style of a known contact after seeing a few examples.
- Language coverage. Scams in smaller languages used to be rare because the writing was hard to fake; this barrier is lower now.
- Volume and variety. Many slightly different versions can be produced quickly, which makes simple pattern-based filters less effective.
Checks that still work
Look at the request, not the prose
Ask what the message wants you to do. Does a delivery notice really need your card number? Would your finance team really change bank details by a casual email? Unusual requests deserve suspicion no matter how elegant the wording.
Inspect the sender and the link
Display names are easy to fake. Check the actual address, and hover over links, or long-press on a phone, to see where they lead before opening. Look for lookalike domains with swapped letters or extra words.
Go around the message
Instead of clicking, open the website by typing its address or using a saved bookmark, then check whether the same notice appears in your account. If the matter is real, it will be there.
Treat attachments cautiously
Unexpected invoices, shared documents and “voicemail” files are classic carriers. If you did not expect the file, ask the sender through another channel.
Protections that reduce the damage
| Protection | Why it helps |
|---|---|
| Passkeys or app-based two-step sign-in | A stolen password alone is not enough to get in. |
| Password manager | It will usually refuse to fill details on a lookalike site, a useful warning. |
| Automatic updates | Closes known holes that malicious attachments try to use. |
| Separate email for sign-ups | Limits how much a leaked address reveals. |
For teams and families
Workplaces do better when reporting is easy and blame-free. A simple “report suspicious email” button, plus a culture where nobody is scolded for clicking and then speaking up fast, shortens the time attackers have. At home, agree that anyone can ask for a second opinion on a strange message.
If you clicked
- Disconnect from the page and do not enter anything more.
- If you typed a password, change it on the real site at once, and anywhere else you reused it.
- Check recent account activity and sign out of other sessions.
- Tell your IT contact or the service provider so they can watch for misuse.
The skill to build is calm scepticism: pause, verify through a route you control, and act only when the request makes sense. That approach holds up whether the message was written by a person or by software.