For many years, one of the most common ways to identify a phishing email was to look for poor spelling, awkward grammar, or unusual wording. The assumption was that legitimate organizations would communicate professionally, while fraudulent messages often contained obvious mistakes. It was a simple rule that was easy to teach and, for a long time, surprisingly effective.
That reality has changed. Cybercriminals now use AI-powered tools to generate convincing emails that are clear, professional, and grammatically correct. The telltale typos and awkward phrasing that once exposed phishing attempts are largely disappearing. In many cases, these messages look and sound just like genuine communications from companies, suppliers, or colleagues you trust.
Why the old advice stopped working
The “look for spelling mistakes” approach worked largely because many phishing emails were written by individuals communicating in a language they were not fluent in. The errors often revealed the scam.
Generative AI has removed that weakness. According to the UK’s National Cyber Security Centre, AI can produce phishing messages without the translation issues, spelling mistakes, or grammatical errors that previously helped people identify fraudulent emails. The FBI has issued similar warnings, noting that criminals are increasingly using AI to create more polished and believable communications. As a result, one of the most widely taught phishing indicators has become far less reliable.
Why these emails are so convincing now
- The writing is clean. AI can generate clear, well-written messages within seconds. Attackers can instruct AI to produce emails that sound formal, friendly, urgent, or authoritative, making phishing messages nearly indistinguishable from legitimate business correspondence.
- It’s personal. Cybercriminals can gather publicly available information from company websites, LinkedIn profiles, social media accounts, and press releases. They can then use AI to create messages tailored to a specific employee, department, or organization. These emails may include familiar names, job titles, projects, or vendors, making them appear trustworthy.
- There’s more of it. AI also allows attackers to generate phishing emails at scale. Instead of manually creating messages one at a time, criminals can quickly produce hundreds or thousands of customized emails. The FBI’s Internet Crime Complaint Center (IC3) highlighted the growing role of AI-driven scams, linking AI-related fraud activity to more than 22,000 complaints and nearly $893 million in reported losses.
Today’s phishing emails rarely resemble the obvious scams of the past. Rather than receiving a generic message claiming your account has been suspended, a finance employee may receive an email that appears to come from a legitimate supplier. It may reference a real project, use accurate contact details, and request updated banking information for future payments. Everything appears legitimate, except the sender isn’t who they claim to be.
Your spam filter won’t catch them all
Many businesses rely heavily on email security solutions, and for good reason. Modern filtering tools successfully block a significant number of malicious messages every day.
However, not every phishing email contains obvious warning signs. A well-written message that appears relevant to your business and contains no suspicious links or attachments may pass through technical defenses. As AI-generated phishing becomes more sophisticated, both the NCSC and FBI expect more of these emails to bypass automated filters. That’s why employee awareness remains such a critical layer of protection.
It’s not just email anymore
The impact of AI extends beyond email. The same technology is now being used to create convincing text messages, voicemails, and phone calls.
The FBI has warned that criminals can clone a person’s voice using only a short audio sample. This allows scammers to leave messages or place calls that sound remarkably similar to a manager, executive, family member, or trusted contact. Just as AI makes phishing emails more persuasive, it can also make fraudulent calls and messages harder to recognize.
The best defense remains the same: whenever someone requests money, sensitive information, or account access, verify the request independently. Contact the person using a trusted phone number or communication method you already have.
Here are the signs you should still pay attention to
If you can’t trust how an email is written, look at what it’s asking you to do. That’s where the real warning signs are, and AI hasn’t changed them:
- It asks for money, gift cards, or a payment to a new account.
- It asks for a login, a verification code, or personal details.
- It creates pressure: a deadline, a threat, or a “do this now.”
- It asks you to change the bank details for an invoice or a supplier.
- It comes with a link or attachment you weren’t expecting.
- The display name looks right, but the actual email address doesn’t match it.
Despite advances in AI, these behavioral warning signs have not changed. The safest approach is to pause and verify before taking action on any request involving money, access credentials, or payment information.
How to protect your team
- Check money and login requests another way. Whenever an email involves payments, banking changes, or account access, confirm the request using a separate communication method. Call a known phone number rather than replying directly to the email.
- Stop telling staff to watch for bad spelling. Shift awareness training away from spelling mistakes and toward recognizing suspicious requests, unusual behavior, and social engineering tactics.
- Make one rule for payment changes: confirm every change to bank details by phone, even when it’s urgent.
- Turn on phishing-resistant MFA or passkeys, so a stolen password is harder to use even if someone gets tricked.
- Make it easy to report a suspicious email and make sure nobody feels silly for checking.
- Remind the team now and then that scam emails look perfect these days. A quick five-minute chat beats a poster nobody reads.
Frequently asked questions
Can you still spot a phishing email by bad spelling and grammar?
Not reliably. AI-generated phishing emails are often professionally written and grammatically correct. Instead of focusing on writing quality, evaluate the request itself and whether it seems unusual or risky.
What are the warning signs that still work?
Look for requests involving payments, bank account changes, login credentials, verification codes, or urgent actions. These indicators remain strong signs of potential phishing attempts.
Is AI-generated phishing really more effective?
Yes. Security agencies such as the NCSC and FBI have warned that AI allows attackers to create messages that are more convincing, more personalized, and easier to scale. As a result, phishing campaigns are becoming increasingly effective.
Will my spam filter stop AI phishing?
It will catch a lot, and you should keep it on. But a well-written, personalized email with no obvious bad link can still look legitimate to a filter, so don’t rely on it alone. A trained person is the backstop.
What should staff do if they aren’t sure about a message?
Take a moment to verify before responding or taking action. Contact the sender through a trusted communication channel and report the email if it appears suspicious.
Sources and further reading
• NCSC: The near-term impact of AI on the cyber threat — Explains how AI is removing many of the traditional indicators used to identify phishing attacks.
• FBI IC3: Criminals Use Generative AI to Facilitate Financial Fraud — Details how cybercriminals are using AI-generated text and cloned voices to make scams more convincing.
If you’d like help training your team to recognize modern phishing threats or implementing phishing-resistant security measures, InnoPrince can help. We work with organizations to strengthen cybersecurity awareness, improve authentication security, and reduce the risk of costly phishing attacks before they happen.