For twenty years, the primary rule of spotting a phishing email was simple: look for bad spelling and clumsy grammar. If the message was riddled with errors, you deleted it. That rule is now worthless. If your team still relies on it, your business is exposed.
Generative AI has eliminated the single biggest warning sign employees were trained to catch. An attacker can now produce a clean, well-written, highly personalized email in seconds. The message references your company by name, mentions a recent purchase, or drops the name of a real coworker. The broken phrasing that used to give away the scam is gone. What remains looks exactly like a normal business communication, because for all practical purposes, it is one.
This is not just a modest bump in quality. It represents a fundamental shift in attack economics. Recent research from Barracuda found that 90 percent of high-volume phishing campaigns now run on phishing-as-a-service kits. These are subscription products. Attackers no longer build fake login pages, hosting infrastructure, or automation tools from scratch. They rent turnkey kits, much like your front desk rents property management software. AI elevates the writing quality of every message while these kits scale delivery. Combine the two, and you get a massive surge in fast, low-cost attacks targeting the exact same number of defenders you had last year.
Because old training methods are obsolete, here is what needs to replace them.
Stop teaching people to evaluate how an email is written. Teach them to evaluate what the email asks them to do. While the grammar may be flawless, the malicious intent remains in the request itself. Social engineering tactics have not changed, even if the wording has improved. Every scam requires the target to take an action, and that action almost always exhibits at least one of three distinct signatures.
The first is artificial urgency designed to bypass standard procedures. The invoice must be paid today. The password must be reset within ten minutes. Gift cards are needed before the manager boards a flight. Speed serves the attacker, because a rushed employee rarely double-checks facts.
The second is a request that violates an established workflow. Your accounting team follows specific steps to pay vendors. Your front desk uses a defined process to issue refunds. When an email asks someone to step outside those guardrails, that is the exact moment to pause, regardless of how executive the sender appears to be.
The third is pressure to remain strictly within the attacker’s communication channel. “Do not call me, just reply here,” or “Handle this over email, I am stuck in a meeting.” Legitimate requests survive verification. Scams do not, which is why attackers work tirelessly to keep you from checking through outside means.
This points to the single most valuable habit you can build across your organization: independently verifying any unusual or high-risk request through a separate, trusted channel. If an email appearing to come from your general manager, bookkeeper, or IT vendor requests something out of the ordinary, confirm it by calling a known phone number or walking over to their office. Do not hit reply. If the email is fake, your response goes straight to the attacker. A quick thirty-second phone call to a verified contact number can instantly expose a scam that an otherwise perfect email tried to conceal.
For hospitality operators managing hotels and multi-property environments, these tactics pose an elevated threat. High staff turnover, multi-shift operations, and geographically dispersed teams mean employees rarely know everyone by sight. Meanwhile, finance and group-booking staff handle wire transfers and large invoices daily, making them prime targets for business email compromise. An AI-crafted message impersonating an owner or familiar vendor fits seamlessly into that environment.
Defending against this does not require a bigger security budget. It requires updating your curriculum and running realistic simulations that reflect modern threats rather than clumsy scams from a decade ago. The goal is not just preventing clicks; it is fostering a security-minded culture where employees pause, verify unexpected requests through trusted channels, and take action when something feels off.
If you want help modernizing your security awareness program, discover how CMIT Solutions is ready to partner with you. As a managed IT and cybersecurity provider, CMIT Solutions delivers up-to-date phishing simulations and tailored employee training designed to defend your team against today’s AI-driven threats.
Source: SC Magazine, “AI killed the typo. Now it’s time to rewrite phishing training,” August 31, 2026.
