- Spelling and grammar no longer reveal phishing. Judge the request, not the writing.
- The sender's real domain and the link's real destination are still the strongest signals.
- Pressure, secrecy and unusual payment requests remain red flags, however well-written.
- Habits beat knowledge: regular realistic practice is what makes people pause.
Why AI changed phishing
For years, the advice was simple: look for bad spelling, odd phrasing and generic greetings. That advice worked because writing convincing emails at scale was hard. It isn't any more. Generative AI writes fluent, polite, context-aware messages in seconds, in any language, and can be fed details scraped from LinkedIn or your website.
The result is phishing that reads exactly like a real email from HR, a supplier or your bank. Email filters struggle too, because there's nothing obviously wrong with the text. The decision increasingly lands on a person, on a busy afternoon, deciding whether to click.
The 7 red flags that still work
1. The sender's real domain doesn't match
AI can write the email, but the attacker still has to send it from somewhere. Ignore the display name and read the actual address. people-team@acme-hr.co is not your company, however friendly the message.
2. The link goes somewhere unexpected
Hover over buttons and links (or long-press on mobile) before clicking. A "View document" button that points to an unfamiliar domain is a lure, no matter how polished the email around it.
3. It's trying to rush you
Urgency is the attacker's most reliable tool, and AI makes it more persuasive, not less. "Please acknowledge by Friday", "final reminder", "your access will be removed today" — when you feel hurried, slow down.
4. It's oddly well-informed
Your name, job title, manager and a recent project are easy to find online. Personal detail used to signal legitimacy. Now it's cheap to fake. An unexpected message that knows a lot about you deserves more scrutiny, not less.
5. It changes how money moves
New bank details, an urgent transfer, gift cards for a client. Any change to payments should be confirmed on a separate channel, using contact details you already have. Never reply to the email to check.
6. It moves you to a different channel
QR codes, "call this number", voice notes or "message me on WhatsApp" all pull you somewhere with fewer protections. AI voice cloning makes the follow-up call convincing too. Verify by contacting the person directly.
7. It asks for secrecy
"Keep this between us for now" is almost never legitimate in a work email. Secrecy exists to stop you checking with a colleague, which is exactly what you should do.
How to train your team to spot AI phishing
Knowing the red flags isn't the same as noticing them at 4pm on a Thursday. The habit that protects people is a short pause before acting, and habits come from repetition.
- Practise regularly. Send realistic practice phishing every month, at random times, so it feels like real life.
- Teach in the moment. When someone clicks a practice email, show them the red flags right then. A 60-second lesson beats an annual video.
- Never blame. People who feel safe admitting mistakes report real attacks sooner.
- Agree simple rules. For example: payment changes are always confirmed by phone.
That's exactly what Lureproof automates for small teams. It's free for up to five people, and our free security training is open to everyone.
FAQ
Can you tell if a phishing email was written by AI?
Usually not from the writing alone. Check the sender's real domain, where links actually go, whether the request is unusual, and whether it pressures you to act fast.
What's the best defence against AI phishing?
Verification habits (checking senders and links, confirming payment changes by phone) combined with regular, realistic practice so staff build the reflex.