AI phishing
AI phishing protection: how to spot AI-generated phishing emails
The old giveaways, bad grammar and odd spelling, are gone. Here's how to spot AI phishing now, and the few habits that protect your accounts even when a fake email gets through.
What is AI phishing?
Phishing is a message that tricks you into giving up a password, a payment or access to a device. AI phishing is the same trick written with AI tools. A scammer can now produce a polished, personal email in seconds, in any language, using details from your website, social media or a past data breach. It might mention your real vendor, your city or a recent order. The same tools write convincing texts (often called smishing), social media DMs, and fake login pages.
Why AI-generated phishing emails are harder to spot
For years the advice was "look for typos." That no longer works. AI-written emails are grammatically clean, match a brand's tone, and can be tailored to one person. Scammers also send them in larger volumes and test which versions get clicks. The good news: AI changes how a phishing email reads, not what it ultimately asks you to do. That's where you catch it.
How to spot AI phishing: what to look for instead of typos
- Urgency or fear: "Your account will be closed today," "Payment failed," "Unusual sign-in detected."
- A request to log in, pay, or change something through a link or attachment in the message.
- A sender that's almost right: a lookalike domain, a free email account for a "company," or a reply-to address that doesn't match.
- Links that don't go where they claim. On a computer, hover to preview. On a phone, press and hold.
- New payment details or a request to pay by gift card, crypto or a payment app.
- Unexpected attachments, especially invoices, "shared documents," or files that ask you to enable something.
- QR codes in emails or on flyers that lead to a login page.
- Requests to keep it quiet or to skip your normal process.
How to protect yourself and your business from AI phishing
- Turn on multi-factor authentication for email, banking, payment apps and social accounts. Prefer an authenticator app or passkey over text codes when offered.
- Use a password manager. It won't autofill your password on a fake site, which is a quiet early warning.
- Go direct. Instead of clicking a link, open the app or type the website address yourself.
- Verify payment changes by phone on a number you already have, never one in the email.
- Keep devices and browsers updated so a malicious link has fewer weaknesses to use.
- For a business email domain, ask whoever manages it to set up SPF, DKIM and DMARC. They make it harder for scammers to send mail that looks like it came from you.
- Make reporting easy. Tell your team exactly where to forward a suspicious message, and thank people who do.
What to do if you clicked a phishing link
- Don't panic, and don't enter anything else. Close the page.
- If you typed a password, change it right away from the real site or app, along with anywhere you reused it, and sign out other sessions.
- Turn on MFA if it wasn't already, and check email settings for forwarding rules you didn't create.
- If you shared card or bank details, call your bank or card issuer now.
- If you opened an attachment on a work device, disconnect it from Wi-Fi and tell whoever handles your IT.
- Report it to the FTC at ReportFraud.ftc.gov, and to the FBI at ic3.gov if money was lost.
How insurance can help after a phishing attack
Phishing is often the first step in something bigger: a hacked email account, a ransomware attack, stolen customer data, or a redirected payment. Cyber insurance can help with breach response, data restoration and lost income, while losses from being tricked into sending money usually need social-engineering fraud coverage. Many insurers also ask whether you use MFA and backups before they'll offer a policy. See cyber insurance for AI scams for what to ask. AI Shield Coverage doesn't sell insurance; we point you to licensed insurers' own quote pages.
Make these habits stick with our free AI Scam Readiness Checklist.
Frequently asked questions
Can AI write phishing emails with no typos?
Yes. That's why typos are no longer a reliable sign. Focus on what the message asks you to do: log in, pay, change details, or open a file.
Are scam texts and social media DMs phishing too?
Yes. Phishing by text message is often called smishing, and the same rules apply: don't tap the link, go to the app or website directly, and verify through a channel you already trust.
Does multi-factor authentication stop phishing?
It blocks a large share of account takeovers, because a stolen password alone isn't enough. Some phishing kits try to steal codes too, so passkeys or authenticator apps are stronger than text codes.
What should I do with a suspicious email?
Don't click or reply. Check it by contacting the sender through a known number or the official app, then report it as phishing in your email app and delete it.