The old advice warning us to watch for bad spelling and clumsy grammar isn’t as useful as it once was. Scammers now use AI to write their emails, meaning the messages arriving in your inbox these days read as well as anything from a legitimate company.
Generative AI can now produce convincing phishing without the translation, spelling and grammatical errors that used to act as red flags warning us that a message was likely a scam.
Worse yet, scammers can feed public details about you and your company into an AI tool, pulled from your website, your team’s LinkedIn profiles, or a press release, and get a message tailored to you: the right names, the right job titles, and a believable reason to be in touch.
You’d like to think your spam filter would catch suspicious messages before they ever reach your inbox, but even the filters can be fooled. A well-written, personalized email that asks a normal-sounding question doesn’t always look dangerous to a filter, especially when it carries no obvious bad link or attachment. The FBI reports that it expects AI to push more of these messages through now that they are easier and faster to produce, which is why the last line of defense is a person who knows what to check.
Here are the signs you still need to watch for:
- It asks for money, gift cards, or a payment to a new account.
- It asks for a login, a verification code, or personal details.
- It creates pressure: a deadline, a threat, or a “do this now.”
- It asks you to change the bank details for an invoice or a supplier.
- It comes with a link or attachment you weren’t expecting.
- The display name looks right, but the actual email address doesn’t match it.
So, the rule is simple: when it is about money, logins, or how you pay someone, slow down before you act. If an email asks you to pay a new account or change a supplier’s bank details, call the person on a number you already have. Institute a rule for payment changes: confirm every change to bank details by phone, even when it’s urgent. Turn on phishing-resistant MFA or passkeys, so a stolen password is harder to use even if someone gets tricked. Make it easy to report a suspicious email and make sure nobody feels silly for checking.
To learn more about keeping your business systems and data secure, contact me at CMIT Solutions today.
