For years, one of the easiest ways to spot a phishing email was the spelling.
Bad grammar. Strange wording. Random capital letters. A slightly odd way of saying something that a genuine bank, supplier or colleague probably wouldn’t use.
It was simple advice, and for a long time it wasn’t bad advice. Unfortunately, cyber criminals have discovered spellcheck. More accurately, they’ve discovered AI.
Generative AI can produce a professional-looking email in seconds. It can correct poor English, change the tone, make a message sound more natural and even rewrite it to sound like it came from a particular type of person.
That means one of the most familiar phishing warning signs is rapidly disappearing.
A scam email can now have perfect spelling, perfect grammar and a perfectly plausible reason for landing in your inbox…
Bad spelling was never really the security control
We need to stop teaching people that badly written emails are phishing emails and well-written emails are safe.
The UK’s National Cyber Security Centre has warned that generative AI can create convincing phishing material without the translation, spelling and grammatical mistakes that traditionally helped people identify suspicious messages.
The FBI has made much the same point. Criminals are using generative AI to make fraudulent messages more believable, produce them more quickly and overcome some of the obvious warning signs people have been taught to look for.
This isn’t a prediction about what phishing might look like in five years. It’s already happening.
AI hasn’t invented phishing. It has improved it.
This is an important distinction. Cyber criminals haven’t suddenly discovered an entirely new attack because ChatGPT exists.
They’re still doing many of the same things they’ve always done:
pretending to be somebody you trust;
creating urgency;
asking you to sign in;
sending fake invoices;
changing supplier bank details;
persuading you to open a document;
getting you to hand over information.
AI simply makes it easier to make those approaches convincing.
Imagine an attacker targeting a small business in Chesterfield. A few minutes looking at the company website and LinkedIn might tell them who the Managing Director is, who works in accounts, what suppliers the company uses and what projects it has recently announced.
That information can then be turned into something far more believable than:
“Dear Sir, kindly make urgent payment.”
Instead, the finance team might receive something like:
“Hi Sarah. Can you make sure the Jones Engineering invoice is paid today? They’ve changed banking provider, so use the updated details attached. I’m in meetings most of the afternoon, so just get it sorted and let me know when it’s done. Thanks, David.”
Perfect English.
Plausible request.
Real names.
Possibly even a real supplier.
Still a scam.
The important clue isn’t the grammar. It’s what the email is asking Sarah to do.
This matters particularly for smaller organisations
A cyber criminal doesn’t need to target a multinational company to make money.
Think about the organisations around Chesterfield, Derbyshire, Sheffield and South Yorkshire.
Schools make payments to suppliers.
Care providers handle sensitive information.
Charities have finance teams and trustees.
Accountants handle financial data.
Trades and construction companies receive invoices and payment requests all day.
Small businesses regularly deal with customers, suppliers and subcontractors by email.
In many of those organisations, the person reading the suspicious email is also trying to answer the phone, deal with a customer and finish five other jobs.
That’s what criminals exploit – they need somebody to be busy.
The numbers show how quickly AI-enabled fraud is growing
The FBI’s 2025 Internet Crime Report recorded 22,364 complaints involving AI-related information, with reported adjusted losses exceeding $893 million.
Business Email Compromise remains particularly relevant.
This is where criminals impersonate a director, supplier, colleague or other trusted person to persuade someone to transfer money or provide sensitive information.
AI makes that impersonation easier to scale and harder to identify purely from the language being used.
But there is an important lesson here. The answer isn’t to teach everyone how to detect whether ChatGPT wrote an email. That’s going to become increasingly difficult and, ultimately, isn’t the point. Instead, concentrate on the behaviour the message is trying to trigger.
Stop asking “Does this email look fake?”
Ask: “What is this email asking me to do?”
That’s a much better phishing test.
Pay particular attention when an email asks you to:
send money;
change bank details;
buy gift cards;
enter your Microsoft 365 password;
provide an MFA or verification code;
open an unexpected attachment;
follow a link to view a document;
reset a password;
provide sensitive information;
bypass the normal process because something is “urgent”.
The more important the action, the more important it is to verify it.
A beautifully written email asking you to transfer £15,000 to a new bank account deserves considerably more scrutiny than a badly written email asking whether you want tea or coffee.
One simple rule can prevent a very expensive mistake
For payment changes, we recommend a very simple process.
Never change someone’s bank details based solely on an email.
Call the supplier using a telephone number you already know to be genuine. Not the telephone number in the email. Not the number in the attached PDF. Not the number in the new signature at the bottom of the message. Use the number already stored in your accounting system, CRM, previous correspondence or another trusted source.
The same principle applies elsewhere.
If your headteacher suddenly emails asking you to buy £500 of gift cards, speak to them. If your Managing Director asks you to send an MFA code, call them. If Microsoft apparently tells you your password expires in 30 minutes, don’t panic and click the link. Open Microsoft 365 yourself.
Build verification into the process rather than expecting somebody to spot every fake.
Your spam filter still matters
There’s another trap here.
We sometimes hear:
“Our staff know what phishing looks like.”
That’s good, but staff awareness shouldn’t be the primary email security system.
People are busy, distracted and human. Even somebody who has completed excellent cyber awareness training can eventually click the wrong thing.
The better approach is layered.
Good email security should prevent as many malicious messages as possible from reaching people in the first place.
Then awareness training helps staff deal with the smaller number that get through.
Then MFA, identity protection, backups and monitoring help limit the damage if something still goes wrong.
Don’t make your employees defend the organisation using nothing more than a five-minute phishing course and good luck.
Microsoft 365 filtering won’t catch everything either
Microsoft 365 includes useful security controls, and they absolutely should be configured properly.
But targeted phishing isn’t always an email carrying an obvious virus.
Modern attacks can involve:
supplier impersonation;
fake invoices;
Microsoft 365 login pages;
QR codes;
shared OneDrive or SharePoint documents;
compromised genuine email accounts;
business email compromise;
links hosted on legitimate cloud services.
A message might therefore look remarkably similar to dozens of genuine messages someone receives every week.
This is why some organisations add another layer of protection.
We use Avanan, now Check Point Email Security to provide additional protection around Microsoft 365 and Google Workspace.
It can help identify phishing, impersonation, suspicious links, malicious attachments and business email compromise before somebody has to decide whether the message is genuine.
It isn’t a replacement for staff awareness.
The aim is to reduce the number of dangerous decisions your staff have to make in the first place.
It’s not only email
AI-generated social engineering isn’t limited to someone’s inbox.
Voice cloning has improved dramatically as well.
A voicemail might genuinely sound like your director. A WhatsApp voice message might sound like a colleague. A caller might sound remarkably like a family member.
The FBI has already warned about criminals using AI-generated voices as part of impersonation and fraud campaigns.
Again, trying to become an expert in detecting synthetic audio isn’t necessarily the answer. Verification is.
If somebody contacts you asking for money, passwords, codes or sensitive information and something doesn’t feel right, independently contact them using details you already trust.
Don’t continue the conversation using the contact information you’ve just been given.
What should we teach staff instead?
We need to modernise phishing awareness.
Stop making spelling mistakes the headline.
Instead, teach people to recognise requests that carry risk.
Money
Anything involving payments, invoices or bank account changes deserves extra checking.
Passwords
Nobody legitimate should be asking you to send them your password.
MFA codes
Treat authentication codes like passwords. Don’t give them to somebody because they sound convincing.
Urgency
“Do this immediately.”
“I’m going into a meeting.”
“We need payment before 4pm.”
Pressure is designed to stop you thinking.
Unexpected links and attachments
Especially login pages, invoices, shared documents and QR codes.
Changes to normal behaviour
A supplier suddenly using a different account.
A colleague asking you to use their personal email.
Your manager asking for something they have never asked for before.
That’s when you verify.
And please make reporting easy
There’s one final part organisations sometimes get wrong.
When somebody reports a suspicious email, don’t make them feel silly.
Even if it’s genuine.
I’d much rather someone asks:
“Kevin, this looks a bit odd. Is it safe?”
and we discover it’s completely legitimate than have them stay quiet because they’re worried about wasting somebody’s time.
Cyber security works much better when people feel comfortable asking.
You want:
“I’m not sure, so I’ll check.”
Not:
“I don’t want to look stupid, so I’ll just click it.”
That cultural difference matters.
The phishing email hasn’t disappeared. It has grown up.
The badly written “Dear Customer” emails haven’t vanished completely.
You’ll still receive plenty of them. But they’re increasingly the easy ones.
The more dangerous phishing messages are the ones that look completely normal.
No spelling mistakes.
No broken English.
No badly copied logo.
Just a believable message arriving at exactly the wrong moment, asking a busy person to do something they probably shouldn’t.
So perhaps the old advice needs updating.
Don’t judge an email by how well it’s written. Judge it by what it’s asking you to do.
Wherever possible, put enough technical protection around your staff that the most dangerous messages never reach them in the first place.
Frequently Asked Questions
Can you still spot phishing emails from bad spelling and grammar?
Sometimes, but it is no longer a reliable test.
Generative AI allows criminals to produce professional, grammatically correct emails in almost any language or tone. A perfectly written email can still be malicious.
Focus instead on what the message is asking you to do.
How is AI being used in phishing attacks?
AI can help criminals write more convincing messages, personalise emails using information available online, translate messages into different languages and produce large numbers of variations quickly.
It can also be used to help create fake images, audio and voice messages for wider social-engineering attacks.
What are the biggest phishing warning signs now?
Pay particular attention to requests involving:
money;
changes to bank details;
passwords;
MFA codes;
unexpected links;
unexpected attachments;
confidential information;
unusual urgency.
Changes from normal behaviour are often particularly important.
Can AI make a phishing email sound like my boss?
Yes.
An attacker can use publicly available information to understand someone’s name, role, writing style and relationships with other people in an organisation.
If the request involves money, credentials or sensitive information, independently verify it regardless of how convincing the message sounds.
Will Microsoft 365 stop phishing emails?
Microsoft 365 provides useful email security, but no filtering system stops every attack.
Targeted phishing, impersonation and business email compromise can be difficult to detect because the message may contain no traditional malware.
Organisations that face greater email risk may benefit from additional protection such as Avanan / Check Point Email Security alongside MFA, DMARC, identity security, backups and staff awareness training.
Does email security replace phishing awareness training?
No.
The two should work together.
Good email security should reduce the number of malicious emails reaching people’s inboxes. Awareness training then helps staff recognise and report suspicious messages that still get through.
What should I do if I’m not sure whether an email is genuine?
Don’t use the contact details contained in the suspicious message.
Contact the person or organisation independently using a telephone number, website or other contact method you already trust.
If you’re at work, report the message to whoever manages your IT or cyber security.
Checking a genuine email costs a few minutes.
Acting on a convincing fake one can cost considerably more.
