How to tell an AI-written phishing email from a real one
The short answer
Grammar is no longer a signal. Modern phishing is written cleanly, in your language, with your name and your company in it. What still gives it away is mechanical: the sender domain, the link destination, the ask, and the channel switch. Five checks, sixty seconds, and you catch nearly all of it.
Why the old advice stopped working
For fifteen years, the practical test was language. Bad spelling, wrong articles, a strange formality. That test is dead. A model can now write a message in your colleague's register, reference the project you mentioned on a call, and keep the tone right for three paragraphs.
Two other things changed with it. Volume went up, because writing a thousand personalised emails now costs the same as writing one. And voice became copyable: a short clip is enough to produce a call that sounds like someone you know asking for a favour.
So the useful question is not "does this read like a scam". It is "what is this message asking me to do, and can I verify it somewhere else".
The seven signals that still work
1. The ask is money, credentials, or access. Almost every phishing attempt ends in one of three places: a payment, a login, or a permission. If the message wants one of those, slow down regardless of how normal it looks.
2. The domain is close, not correct. Display names are free. Look at the actual address: the part after the @. A letter swapped, a hyphen added, a .co instead of .com. On mobile, tap the sender name to expand it.
3. The link text and the destination disagree. Hover on desktop, long press on mobile. If the visible words say your bank and the address says something else, stop there. Nothing later in the message matters.
4. It moves you to another channel. A request to continue on WhatsApp, Signal or a personal number is a way around your company's filters. Legitimate finance and IT requests do not usually start that way.
5. Payment details changed. An invoice from a supplier with new bank details is the single most expensive version of this attack. Verify by calling a number you already had, never one from the email.
6. The attachment is not what it claims. HTML files that open a fake login page, zipped files, calendar invites that add themselves. If you did not ask for a document, do not open it to find out what it is.
7. The context is slightly wrong. Right name, wrong project. Right company, wrong manager. AI writes well, but it works from scraped fragments, so the detail that does not fit is often the only tell left.
The sixty-second routine
Stop. No reply, no click, no forwarding. Urgency is the delivery mechanism, so the first move is always to break it.
Read the address, not the name. Expand the sender on mobile. Check the domain against the last email you had from that company.
Check the link by hovering or long pressing. If the destination is wrong, delete.
Verify on a channel you chose. Call the number on the card, open the app yourself, message the person in a thread you started. Never use the contact details inside the suspicious message.
Report and delete. One click on report trains the filter for everyone else in the organisation, which is the only defence that scales.
What detection tools can and cannot do
Mail filters are good at known bad domains and attachments, and they are getting better at behavioural signals such as a first-time sender asking for money. Use them.
What they cannot do is tell you whether a paragraph was written by a model. Text watermarks exist in research settings and are not something you can check from your inbox, and consumer "AI detector" scores are unreliable enough that basing a security decision on one is worse than ignoring it. Judge the request, not the prose.
If you already clicked
Change the password from a different device, then sign out of all sessions. Turn on multifactor authentication if it was off, and check forwarding rules in your mailbox, because attackers add one so they keep reading after you change the password. If credentials for a bank or a payment tool were entered, call the institution and say what happened. Speed matters more than embarrassment.
Questions people ask
Can AI detection tools spot a phishing email?
Not reliably. Text watermarking is not something a reader can verify, and detector scores produce false positives on ordinary writing. Check the sender domain, the link destination and the request instead.
Is perfect grammar still a warning sign?
No. Perfect grammar is now the default. The remaining tells are structural: wrong domain, mismatched link, unusual channel, or a payment request that arrived out of the blue.
What is the single best protection?
Multifactor authentication, ideally a passkey or an app rather than SMS. It does not stop the email arriving, but it stops a stolen password from becoming a stolen account.
Read next: what Black October actually changed this week
Also read: the six controls that would have stopped the incidents and what to give an agent, and what to withhold.