The old advice — look for bad spelling, broken English, weird formatting — genuinely doesn't work anymore. Attackers now use AI to write phishing emails, and the results are polished, professional, and personalized, sometimes reading better than a legitimate company's actual emails. The old signals used to catch the majority of phishing attempts; they now catch almost nothing. Here's what actually still works.
Why the Old Rules Stopped Working
AI-generated phishing emails achieve dramatically higher click-through rates than the old-style manually written scams, precisely because the grammar and formatting tells people were trained to spot have disappeared. Attackers now study company communication styles, replicate exact formatting, and time their attacks to coincide with real business activity — a fake IT notice sent the day after a real cloud outage, for example, using genuine news to manufacture urgency.
Red Flag #1: The Sender's Actual Domain, Not the Display Name
This is the single most reliable signal left. A display name can say "Microsoft Security" or "PayPal Support" while the actual email address is something completely unrelated. On desktop, hover over (don't click) the sender name to reveal the full address. On mobile, tap the sender name. If the domain is even one character off from the real organization's domain — an extra letter, a zero replacing an "o," a different extension — that's a confirmed red flag, not a coincidence.
Red Flag #2: Where the Link Actually Goes
The visible text of a link and its actual destination are often completely different. Before clicking anything, hover over the link (desktop) or long-press it (mobile) to preview the real URL in your browser's status bar. If a security or account email links anywhere other than the organization's own exact domain, treat it as confirmed phishing.
Red Flag #3: Manufactured Urgency
"Your account will be suspended in 24 hours" still works because pressure short-circuits careful thinking. Legitimate organizations rarely demand instant action without prior contact or a reasonable grace period. AI-generated phishing has actually made this more sophisticated — instead of generic threats, attackers now generate hyper-specific, news-driven urgency tied to real current events, making the pressure feel more credible.
Red Flag #4: A Sudden Change in Behavioral Baseline
This is one of the newer, more reliable signals specifically for AI-generated phishing. If someone who normally sends short, informal one-line emails suddenly sends a beautifully structured, perfectly punctuated three-paragraph message, that shift itself is suspicious — AI-written impersonations often lack the small human inconsistencies of how a specific person actually writes.
Red Flag #5: Unexpected Attachments or QR Codes
If you didn't request a file, don't open it — phishing attachments are commonly disguised as invoices, shipping labels, or shared documents. QR codes embedded in emails ("quishing") are a growing vector specifically because they bypass the link-preview habit people have built up; never scan a QR code from an unsolicited email.
Red Flag #6: Requests for Passwords or Sensitive Data
No legitimate bank, employer, or service will ever ask for your password, PIN, or full card details directly via email. Any email that redirects you to a form requesting this information should be treated as phishing, regardless of how convincing the surrounding email looks.
The One Habit That Stops Almost Everything
Verify any request involving money or credentials through a second channel — a phone call, a Slack message, walking over to someone's desk — every single time, no exceptions. This one habit stops the vast majority of successful phishing and business email compromise attacks, regardless of how convincing the email itself is.
If You've Already Clicked Something Suspicious
Act quickly, in this order:
- Disconnect from the internet immediately if you entered any credentials
- Change the affected password (and any reused elsewhere) from a different, clean device
- Enable multi-factor authentication if it wasn't already on
- Check for unusual account activity or unfamiliar login sessions and revoke them
- Report it to your IT/security team if this happened on a work account
Frequently Asked Questions
Can AI-generated phishing emails really have zero grammar mistakes?
Yes. This is precisely why the old spelling-and-grammar advice is outdated — modern phishing emails are frequently linguistically flawless, matching real corporate writing style closely.
Is it safe to reply to a suspicious email to ask if it's real?
No. Replying confirms your email address is active and monitored, which can increase future targeting. Instead, verify through a separate, known channel (calling the organization directly using a number from their official website, not one provided in the email).
What's the fastest single check I can do on any suspicious email?
Hover over the sender's actual email address (not the display name) and compare it character-by-character to the organization's real domain. This single check catches a large share of phishing attempts on its own.
