How to Spot a Phishing Email When AI Writes It Perfectly

Phishing emails are not as easy to catch by bad writing alone anymore. The National Cyber Security Centre in the UK and the FBI have both confirmed that AI now writes these messages cleanly, personally, and convincingly. Spelling and grammar mistakes are still worth flagging, but be just as cautious of any message that asks for money or login details, pressures you to act immediately, or asks you to change bank details on an invoice.

Your team has probably been trained to watch for one thing when a suspicious email lands in their inbox: bad spelling and awkward phrasing.

For years, that was a reasonable place to start. Real businesses write properly, the thinking went, so a message full of mistakes was worth a second look. It was simple to teach, and on its own it used to be enough.

It is not enough on its own anymore.

Attackers now use AI to write their phishing emails, so the typos and awkward phrasing that used to give the game away are increasingly rare. The messages arriving in your inbox can read as professionally as anything from a real client, vendor, or coworker. Some are even written to sound like they came from someone your team already trusts.

In this article, you will learn why spelling and grammar can no longer be the only test for a scam email, what makes AI written phishing so convincing, why your spam filter cannot be your only line of defense, how the same tactic now reaches your team by phone and text, and which warning signs still hold up.

Why Spelling and Grammar No Longer Reveal a Phishing Email

The old advice worked for a simple reason. Many scammers were writing in a language that was not their own, and it showed. AI has closed most of that gap.

The UK’s National Cyber Security Centre reports that generative AI can now produce phishing messages without the translation errors, misspellings, and grammar mistakes that used to expose them. The FBI has issued a similar warning, pointing out that criminals now use AI specifically to eliminate the errors that once flagged a message as fraudulent.

A message riddled with mistakes should still raise a flag. The change is that a clean, professional email can no longer be assumed safe simply because it reads well, which is why the signs below matter more now than the writing itself.

What Makes AI Phishing Emails So Convincing

• The writing reads like a real business email. AI can produce polished, professional copy in seconds, in whatever tone an attacker requests.
• The message is personalized to your business. Attackers can pull public details from your website, your team’s LinkedIn profiles, or a press release, then feed that into an AI tool to produce a message with the right names, the right titles, and a believable reason to reach out.
• There is simply more of it. AI lets attackers produce messages faster, so they send far more of them. The FBI’s Internet Crime Complaint Center added an AI specific section to its annual report for the first time this year, linking it to more than 22,000 complaints and nearly $893 million in reported losses.

The result is that the obvious scam email is becoming rare. Instead of a generic warning about a suspended account, someone on your finance team might receive a message that appears to come from a supplier they work with regularly, references an actual project, and asks them to update the bank details on the next invoice. Nothing about how it is written raises a flag. The only thing wrong with it is that the supplier never sent it.

Why Your Spam Filter Cannot Catch Every Phishing Email

It is tempting to assume your email security will handle this for you, and it should stay switched on because it does stop a great deal. But a polished, personalized message that asks a reasonable sounding question, with no obvious bad link or attachment, does not always register as a threat to a filter. Both the NCSC and the FBI expect more of these messages to get through as AI use grows, which is exactly why a trained person still needs to be your last line of defense.

Phishing Has Moved to Phone Calls and Text Messages Too

AI has made the same shift possible outside of email. The FBI warns that a short audio clip is now enough for criminals to clone a voice convincingly, which means a voicemail that sounds exactly like your boss or a family member asking for an urgent payment may not be genuine. Whatever makes an AI written email convincing applies just as well to a call or a voicemail. The response should be the same either way: if a call or voicemail asks for money or login information, hang up and call the person back on a number you already have on file, not one the message gives you.

The Phishing Warning Signs That Still Work

Keep checking the writing, but do not stop there. Shift more of your attention to what the message is asking for, since that is where AI has not changed a thing:

• A request for money, gift cards, or payment to a new account.
• A request for a login, a verification code, or other personal details.
• Pressure to act immediately, through a deadline or a threat.
• A request to change bank details on an invoice or a supplier account.
• A link or attachment your team was not expecting.
• A display name that looks right, paired with an email address that does not match it.

Every one of these is about the request, not the writing. That makes the rule easy to teach: whenever a message touches money, logins, or payment details, your team should slow down before acting on it.

How to Train Your Team to Spot Phishing Emails

• Verify money and login requests through a second channel. If an email asks your team to pay a new account or change a supplier’s bank details, have them call the person using a number they already have on file, not a reply or a number the email provides.
• Broaden what your team checks for. Keep an eye out for typos and awkward phrasing, since even a small mistake is still a fair reason to pause, not just an obviously sloppy email. Layer in a look at the actual request as well, and encourage your team to slow down whenever it touches money or logins.
• Set one firm rule for payment changes. Every change to bank details should be confirmed by phone, even when the request feels urgent.
• Add MFA or passkeys that resist phishing. This way, even if someone is tricked into handing over a password, it is much harder for an attacker to use it.
• Make reporting a suspicious email easy and judgment free. Nobody on your team should feel embarrassed for flagging something that turns out to be legitimate.
• Keep the conversation going. A short, regular reminder that scam emails look flawless today does more than a poster nobody reads.

Conclusion

The rule your team has relied on for years, that bad spelling gives a scam away, no longer works by itself, because AI now writes these messages cleanly, personally, and at scale. That does not mean spelling stops mattering: a small typo or an odd turn of phrase is still worth flagging. But training your team to also weigh what it is asking for, a payment, a login, or a change to how money moves, is what will actually keep your business protected.

Not sure whether your current security awareness training reflects how phishing works today? Contact Atekro and let’s look at where the gaps might be and what practical steps would close them.

Frequently Asked Questions

Can bad spelling and grammar still help identify a phishing email?

To some degree. A message full of typos or awkward phrasing should still make you pause. But a clean, professional email is no longer proof of anything, since AI lets attackers produce exactly that. Weigh the request being made just as heavily as the writing quality.

What warning signs are still reliable?

Anything involving a payment, a change to bank details, a request for a login or code, or pressure to act quickly. These signs hold up regardless of how well the message is written.

Is AI written phishing actually more effective than older scam emails?

The evidence suggests yes. Both the NCSC and the FBI have warned that AI produces more convincing, more personalized phishing attempts, and the FBI has linked AI to tens of thousands of complaints and hundreds of millions of dollars in losses. Messages that read as legitimate are simply more likely to be opened and acted on.

Will spam filters catch AI generated phishing?

They will stop a large share of it, so keeping them enabled still matters. But a well written, personalized message without an obvious malicious link can slip past a filter, which is why your team should not be your only safeguard.

What should an employee do if a message feels off but they cannot pinpoint why?

Encourage them to verify through a channel they trust, such as calling a known number or checking with the person directly, and to report the message regardless of the outcome. A false alarm costs far less than a real one.