Spotting Phishing Messages Now That Scammers Use AI

For years, the standard advice for spotting a scam message was to look for clumsy grammar, odd spelling and strange formatting. That advice has aged badly. AI writing tools now let scammers produce polished, convincing messages in seconds, tailored to the person reading them. The old tells are fading, but the underlying tricks haven't changed much — and those are what to watch for.

What AI has changed for scammers

• Clean writing — messages read naturally, in the right tone, often in your own language
• Personal details — information scraped from social media or past data leaks can be woven in to make a message feel targeted
• Scale — one person can generate many varied messages, so you won't always see the same wording twice
• Voice and video — cloned voices and altered video can impersonate someone you know or work with

The signs that still work

However well a message is written, it usually needs you to do something quickly, without checking. That pressure is the most reliable warning sign there is.

• Urgency or fear — an account about to be closed, a parcel that will be returned, a payment that failed, a relative in trouble
• An unusual request — gift cards, a new bank account for an existing payment, a one-time code, or remote access to your device
• A mismatch in the details — a sender address that's slightly off, or a link whose real destination doesn't match the company it claims to be
• A request for secrecy — being told not to mention it to anyone else is a classic manipulation tactic

Verify through a separate channel

The single most effective habit is to check a request using a route you already trust, not the one the message provides. If your bank texts you, open its app or call the number on the back of your card. If a colleague emails asking for an urgent transfer, message or call them on a contact you already have. Don't use the phone number or link inside the suspicious message itself.

Treat voices and caller ID with caution

Caller ID can be faked, and a familiar voice is no longer proof of identity. If someone calls in distress asking for money, hang up and call them back on their usual number. Some families agree on a code word for exactly this situation, which is a simple check that doesn't depend on how convincing the voice sounds.

Reduce the damage if one gets through

Nobody spots every scam, so it helps to limit what a single mistake can cost. Using a unique password for each account means one stolen password doesn't unlock the rest. Two-factor authentication — ideally an authenticator app, passkey or security key — adds a barrier even if a password is phished. And a password manager can help in a quieter way: it won't offer to fill your login on a fake site, because the address doesn't match.

A calmer way to think about it

You don't need to judge whether every message was written by a person or a machine. You only need to notice when a message is pushing you to act quickly on something sensitive, and then slow down and check. That habit works no matter how good the writing gets, and it's worth sharing with older relatives and anyone else who might be targeted.

Frequently Asked Questions