For years, the standard advice for spotting a scam email was to look for bad grammar. That tip is wearing out. Generative AI writes clean, natural prose in dozens of languages, and security agencies have been warning that it removes one of the oldest tells.
What the agencies are saying
The UK’s National Cyber Security Centre (NCSC) assessed in January 2024 that AI provides capability uplift in reconnaissance and social engineering, “almost certainly” making both more effective and harder to detect. It warned that through 2025 generative AI would make it hard for everyone, whatever their level of cyber security understanding, to judge whether an email or password reset request is genuine. The NCSC’s 2025 annual review went further, noting that researchers had identified fully automated spear-phishing campaigns.
The same NCSC reporting is careful about scale. AI is described mainly as improving existing methods rather than creating new kinds of attack, and the agency says its biggest concern is AI-assisted vulnerability research rather than phishing. It also notes that defenders benefit too, since AI can help detect malicious email.
The FBI has issued parallel advice for fraud. In a December 2024 public service announcement, it said generative AI lets criminals commit fraud at larger scale, makes schemes more believable and helps them correct the errors that might otherwise tip people off.
What gets easier for attackers
Several costs fall at once. Fluent writing no longer requires a skilled writer. Messages can be tailored by feeding in details from public profiles, which turns generic bulk mail into targeted spear phishing. Thousands of slightly different versions make it harder for filters to catch a repeated template.
Audio is the fastest-moving frontier. The FBI describes criminals using short recordings of a loved one’s voice to pose as a relative in a crisis and ask for money, and AI-generated audio to impersonate people in an attempt to get into bank accounts. For finance teams, that raises the stakes on phone requests that sound like an executive.
Signs that still work
When polish is no longer evidence of legitimacy, the situation becomes more informative than the prose.
Pressure is the oldest tell and still reliable: a locked account, an unpaid invoice, a relative in trouble, all with a deadline. Requests for money, one-time codes or credentials by message are unusual from real organizations. A changed payment detail on an invoice, a link you were not expecting and a sender address one character off from the genuine one all deserve a pause. So does any request to keep something secret.
Habits that hold up
The most dependable defense is to verify through a channel you control. Do not use the phone number or link in the message. Look up the organization’s own contact details, or call the person back on a number you already have. The FBI also recommends agreeing a secret word or phrase with family members so a cloned voice cannot pass as a relative, and it advises hanging up and calling back instead of trusting an inbound call.
Slowing down defeats much of the urgency, and organizations can build the delay into process. Requiring a second person to approve changes to bank details, for instance, stops many invoice frauds regardless of how convincing the email looks.
Defenses that do not rely on spotting the fake
Some protections work even when a message fools you. Sign-in methods that are tied to the genuine website, such as passkeys and security keys, will not hand credentials to a lookalike page. Standard multi-factor authentication helps too, though codes can still be relayed by a skilled attacker, as our comparison of authentication methods explains. Email authentication standards such as SPF, DKIM and DMARC help receiving servers check that a message really came from the domain it claims.
If you did click
Move quickly. Change the password on the affected account and anywhere you reused it, turn on multi-factor authentication, tell your bank if you shared financial details, and alert your IT or security team so they can look for wider damage. In the United States, fraud can be reported to the FBI’s Internet Crime Complaint Center.
This is general information, not a substitute for professional security advice.
