AI phishing emails
"Look for bad spelling" used to be the advice. AI fixed the spelling. Here is what still gives a phishing email away.
What changed
Scammers now use AI to write fluent, polite, personalised emails in any language, and can mention your company, your boss or a recent order. The writing is no longer the clue. The request is.
Signs that still work
- The sender's real address doesn't match the company (tap or hover on the name to see it).
- The link goes somewhere else: hover or long-press to see the real address before you tap.
- Urgency: "within 24 hours", "account suspended", "final notice".
- An unusual request: buy gift cards, change bank details, "approve this sign-in", send a code.
- Secrecy: "keep this between us", "I'm in a meeting, just do it".
- Attachments you weren't expecting, especially invoices and "documents to sign".
The one rule
Don't act on the email itself. If it might be real, go to the company's site or app yourself, or call a number you already have. A real request will still be there.
Report it
- Use your email app's "report phishing" button.
- At work, forward it to your IT or security team.
- You can also forward phishing to [email protected].
Train your eye on a real AI →
Questions
Can I tell from the writing that AI wrote it?
Sometimes (see the signs of AI writing guide), but legitimate companies use AI to write emails too. The request and the links matter more than the style.
I clicked the link. What now?
Don't enter anything. If you did, change that password at once from the real site, turn on two-step sign-in, and tell your bank or IT team.