Sound Networks IT Support
Sound Networks IT Services
IT Support
Managed IT Services
Cyber Security
AI
Insights
Company

Request free IT audit

This site uses cookies for functionality and analytics Manage Close

Scammers are using AI tools

Why the old advice stopped working

For years, poor spelling and grammar were useful signs of phishing, particularly when scammers were writing in a language that wasn't their own. AI has largely removed that giveaway.

The UK's National Cyber Security Centre (NCSC) says generative AI can create convincing phishing messages without the spelling and grammatical mistakes that often exposed them. The FBI has issued similar warnings. Perfectly written emails can still be scams, so focus on what the message is asking you to do.

Why AI phishing is so convincing

The writing is clean

AI can produce professional-sounding emails in seconds and in almost any tone.

It's personal

Attackers can use publicly available information, such as company websites, LinkedIn profiles and press releases, to create believable, targeted messages.

There's more of it

AI makes scams faster to produce, allowing criminals to send far more messages. The FBI has linked AI to more than 22,000 complaints and nearly $893 million in reported losses.

Today's scams are less likely to say "Dear customer, your account is suspended". Instead, an attacker might impersonate a genuine supplier, reference a real project and ask for bank details to be changed. Everything can look legitimate except the fact that the supplier never sent it.

Your spam filter won't catch them all

Spam filters remain important, but they won't catch every well-written, personalised message, particularly when there are no obvious malicious links or attachments. That's why people remain an important last line of defence.

It's not just email

AI is also making phone and text scams more convincing. Criminals can clone a person's voice from a short recording and use it to make convincing requests for money or sensitive information. If a call or voicemail asks for money or login details, hang up and contact the person using a number you already trust.

The warning signs that still matter

Don't focus on how an email is written. Look at what it's asking you to do:

  • Ask for money, gift cards or payment to a new account.
  • Request a password, verification code or personal information.
  • Create urgency through deadlines or threats.
  • Ask you to change a supplier's bank details.
  • Include an unexpected link or attachment.
  • Use a display name that doesn't match the actual email address.

The rule is simple: if a message involves money, logins or payment details, slow down and verify it before acting.

How to protect your team

Verify financial and login requests separately

Call using a trusted number rather than replying to the email.

Stop relying on spelling and grammar

Teach staff to focus on the request itself.

Verify

Always verify bank-detail changes by phone, even when the request appears urgent.

Use MFA

Use phishing-resistant MFA or passkeys to reduce the impact of stolen passwords.

Training

Make suspicious emails easy to report and encourage staff to check rather than worry about getting it wrong.

Awareness

Regularly remind staff that modern phishing emails can look completely genuine.

Frequently Asked Questions

Can you still spot phishing by bad spelling and grammar?

Not reliably. AI can produce professional, error-free emails. Focus instead on what the message asks you to do.

What warning signs still work?

Requests for money, bank-detail changes, passwords or verification codes, particularly when combined with pressure to act quickly.

Is AI-generated phishing more effective?

AI makes phishing more convincing, personalised and scalable. The NCSC and FBI have both warned about its increasing use by criminals.

Will my spam filter stop AI phishing?

It will catch many threats, but not all. A convincing, personalised message without obvious malicious content can still get through.

What should staff do if they're unsure?

Stop and verify the request through a trusted channel, such as calling a known number or speaking to the person directly. Report the message even if it turns out to be genuine.

Watch Guard network security partner
Datto ticketing and management system
Huntress security partner
Dell Technologies and services
Hyper-V routing technologies
BitDefender defending your hardware
Microsoft 365 professional services
3CX VoIP phone systems
Veeam partner
Signable partner
Cyber Essentials Certification
Power Automate automation workflows
GTIA
Watch Guard network security partner
Datto ticketing and management system
Huntress security partner
Dell Technologies and services
Hyper-V routing technologies
BitDefender defending your hardware
Microsoft 365 professional services
3CX VoIP phone systems
Veeam partner
Signable partner
Cyber Essentials Certification
Power Automate automation workflows
GTIA
Need Help?