For years, security training told people to look for spelling mistakes, odd grammar and generic greetings. Those clues were useful because many phishing emails were rushed, badly written and sent in bulk.
Generative AI has changed the picture. Criminals can now produce fluent, well-structured, personalised messages in seconds, in any language and any tone. The old tells are disappearing.
What’s different now
Polished writing. AI tools produce clean, professional text. A phishing email can now read exactly like a genuine message from a supplier or colleague.
Personalisation at scale. Attackers can combine publicly available information, such as job titles, recent company news and LinkedIn posts, with AI to tailor messages to individuals, quickly and cheaply.
Convincing impersonation. AI can mimic a particular writing style, and voice cloning technology can imitate a known person on the phone.
New channels. Phishing isn’t just email any more. It arrives by text, collaboration tools, social media and QR codes.
What still gives phishing away
The good news is that the fundamentals of a scam haven’t changed. Attackers still need you to do something, and the request is still the best clue.
Look for messages that:
- Create urgency or pressure. “Today”, “immediately”, “before the end of the day”.
- Ask for something unusual. Changing bank details, buying gift cards, sharing a password, approving an unexpected login.
- Bypass normal process. “Don’t go through the usual system”, “keep this between us”.
- Lead you somewhere to log in. A link to a sign-in page you didn’t go looking for.
- Arrive at a convenient moment for the attacker, such as late on a Friday or when the real sender is known to be away.
Shift training from “spot the typo” to “check the request”
Training needs to evolve. Instead of teaching people to hunt for errors, teach them to question requests, especially ones involving money, credentials or data, and to verify through a separate, trusted channel.
Realistic phishing simulations help enormously. They let people practise recognising modern attacks in a safe environment, and they show you where extra support is needed.
Technology still matters
People are one layer of defence, not the only one. Strong email security filters out a large share of malicious messages before they reach inboxes. Multi-factor authentication limits the damage if someone does enter a password. And 24/7 monitoring can spot a compromised account quickly.
Three examples of modern phishing
The supplier update. A well-written email from a genuine supplier’s address, sent from a compromised account, explains that their bank has changed and attaches a convincing letter on headed paper. There are no spelling mistakes and the tone matches previous messages. The clue is the request itself: a change of bank details should always be verified by phone on a known number.
The shared document. A message appears to come from a colleague, saying they’ve shared a document for review. The link leads to a perfect copy of a familiar sign-in page. The clue is the unexpected request to log in. Going directly to the service, rather than following the link, avoids the trap.
The urgent call. A finance assistant receives a voice message that sounds exactly like a director, asking for an urgent payment before a deadline. The voice was generated from online videos. The clue is urgency combined with a request to bypass process.
In each case, the message looks right. What gives it away is what it’s asking you to do, and the pressure to do it quickly. Teaching people to focus on the request, not the presentation, is the most effective defence against AI-assisted phishing.
Stay a step ahead
CyberQ’s Phishing Training uses realistic, up-to-date simulations to help your people recognise modern, AI-driven attacks, with clear reporting so you can measure improvement. Get in touch to see how your team would fare.
