For years, poor spelling and grammar were useful signs of phishing, particularly when scammers were writing in a language that wasn't their own. AI has largely removed that giveaway.
The UK's National Cyber Security Centre (NCSC) says generative AI can create convincing phishing messages without the spelling and grammatical mistakes that often exposed them. The FBI has issued similar warnings. Perfectly written emails can still be scams, so focus on what the message is asking you to do.
AI can produce professional-sounding emails in seconds and in almost any tone.
Attackers can use publicly available information, such as company websites, LinkedIn profiles and press releases, to create believable, targeted messages.
AI makes scams faster to produce, allowing criminals to send far more messages. The FBI has linked AI to more than 22,000 complaints and nearly $893 million in reported losses.
Today's scams are less likely to say "Dear customer, your account is suspended". Instead, an attacker might impersonate a genuine supplier, reference a real project and ask for bank details to be changed. Everything can look legitimate except the fact that the supplier never sent it.
Spam filters remain important, but they won't catch every well-written, personalised message, particularly when there are no obvious malicious links or attachments. That's why people remain an important last line of defence.
AI is also making phone and text scams more convincing. Criminals can clone a person's voice from a short recording and use it to make convincing requests for money or sensitive information. If a call or voicemail asks for money or login details, hang up and contact the person using a number you already trust.
Don't focus on how an email is written. Look at what it's asking you to do:
The rule is simple: if a message involves money, logins or payment details, slow down and verify it before acting.
Call using a trusted number rather than replying to the email.
Teach staff to focus on the request itself.
Always verify bank-detail changes by phone, even when the request appears urgent.
Use phishing-resistant MFA or passkeys to reduce the impact of stolen passwords.
Make suspicious emails easy to report and encourage staff to check rather than worry about getting it wrong.
Regularly remind staff that modern phishing emails can look completely genuine.
Not reliably. AI can produce professional, error-free emails. Focus instead on what the message asks you to do.
Requests for money, bank-detail changes, passwords or verification codes, particularly when combined with pressure to act quickly.
AI makes phishing more convincing, personalised and scalable. The NCSC and FBI have both warned about its increasing use by criminals.
It will catch many threats, but not all. A convincing, personalised message without obvious malicious content can still get through.
Stop and verify the request through a trusted channel, such as calling a known number or speaking to the person directly. Report the message even if it turns out to be genuine.

























