AI phishing
The typo is no longer a tell. The message can sound exactly like someone you work with.
Phishing is still “a message that tricks you into handing over access, money, or data.” Generative AI makes those messages more fluent, more personal, and easier to produce at scale. Polished English is no longer evidence that a message is safe.
What changed
Classic phishing was often easy to laugh at: broken grammar, generic “Dear Customer,” a clumsy logo. Those tells still appear, but they are no longer something you can count on. A model can draft a tight email in your company’s tone, mention a real project name found on a public page, and translate the same lure into several languages.
The request is usually familiar: open a document, approve a payment, reset a password, “confirm your inbox,” or install a helpful app.
What to inspect, every time
Look at the plumbing, not the prose. Who is the message really from? Where does the link actually go? Were you expecting this? Would this person normally ask you for this, in this way?
- Check the actual email domain, not the display name. A lookalike domain may change one letter, or use a different ending (.co instead of .com, or a hyphen that should not be there).
- Hover or long-press links before you open them. If in doubt, navigate to the site yourself by typing the address you already know.
- Unexpected attachments — especially zip, exe, iso, or “invoice” files — are a reason to stop, not a reason to hurry.
- A request for a password, a one-time code, or a payment should be confirmed on a channel you already use, with a person or a system you already know.
For teams
Make it cheap and safe to report a suspicious message. People hesitate when they fear looking naïve. A short internal path (“forward it to security / the founder / this mailbox”) catches more than any filter alone.
Turn on multi-factor authentication on email and on admin tools, and prefer an authenticator app or a security key over SMS where you can. MFA does not fix a bad payment process, but it raises the cost of a stolen password.
- DeepfakesA fake video or photo can put words — or a face — where they never were.
- Voice-clone scamsA short clip of your voice can be enough for someone to call “as you.”
- Data scrapingPublic pages and leaky forms can be vacuumed up and reused against you later.
- Business email compromiseSomeone posing as a boss or a vendor talks your team into sending money or data.