The biggest phishing warning sign has disappeared
For years, we’ve told people to watch out for poor spelling and bad grammar. If an email looked like it had been written in a hurry by someone who’d never seen a dictionary, chances were it wasn’t genuine.
That advice worked. Until AI arrived.
The uncomfortable truth is that many phishing emails now look better than some legitimate business emails.
The spelling is perfect.
The grammar is spot on.
The branding looks right.
The tone sounds professional, and that’s exactly the problem.
A recent study by KnowBe4 found that 86% of phishing attacks analysed over the past six months showed signs of AI assistance. Criminals are using the same tools that businesses use to write marketing content, emails and reports.
The difference is that they’re using them to steal passwords, access accounts and trick people into handing over information.
For small businesses, schools and care providers, that changes the game.
The old advice isn’t wrong. It’s just incomplete.
When we run cyber security awareness sessions, somebody will usually say:
“I always look for spelling mistakes.”
That’s still worth doing. The problem is that criminals have discovered spellcheck too.
What we’re seeing now are phishing emails that look convincing enough to get past both technical controls and human instinct.
Microsoft 365 password expiry notices.
Shared document notifications.
Electronic signature requests.
Missed voicemail alerts.
Invoices.
They’re familiar, believable and increasingly difficult to spot at first glance.
The website matters more than the email
The question isn’t whether the email looks genuine, it’s where it’s trying to take you.
That’s where many attacks still fall apart.
A fake Microsoft login page may look identical to the real thing, but it won’t be on Microsoft’s website.
The logo can be copied.
The colours can be copied.
The wording can be copied.
The web address can’t.
Before entering a password, take a second to look at the address bar. That simple habit can stop a surprising number of attacks.
Criminals are now borrowing trust
One of the more interesting findings from the research was how attackers are building phishing websites. In the past, fake websites were often hosted on obscure domains that looked suspicious.
Today, many are being built using legitimate website-building platforms.
The platform itself is genuine.
The phishing page sitting on it isn’t.
That makes life harder for security products that rely heavily on reputation checks.
It also means people need to rely less on whether something “looks professional” and more on whether it makes sense.
The best defence is still a healthy dose of scepticism
Technology helps.
Strong email security helps.
Multi-factor authentication helps.
But none of those replace common sense.
The organisations that deal with cyber threats best aren’t necessarily the ones with the biggest budgets. They’re the ones where people feel comfortable questioning something that doesn’t look quite right.
Nobody gets criticised for checking.
Nobody gets rushed into clicking.
Nobody worries about asking what might seem like a silly question.
That culture matters, because cyber criminals don’t need everyone to fall for an attack. They only need one person.
What should businesses be teaching staff?
Less focus on spelling mistakes.
More focus on verification.
If an email asks you to log in, check where you’re logging in.
If someone asks for money, verify the request.
If something feels urgent, slow down.
If something feels odd, ask.
AI has made phishing emails more convincing.
It hasn’t made cyber criminals trustworthy.
The trick is no longer spotting the typo.
It’s spotting the lie.
If your staff are still being taught that bad grammar is the biggest warning sign of a phishing email, they’re preparing for the attacks of five years ago.
The criminals have already moved on.
To learn more about our security awareness training solutions, please visit: https://blackswancyber.co.uk/security-awareness-training-chesterfield-sheffield-phishing-protection-for-businesses/ or contact us for more details.
