For twenty years, anti-phishing advice rested on a comforting assumption: scam emails look wrong. Bad grammar. Odd phrasing. A greeting that says "Dear Valued Customer". We trained people to spot the tells, and for a long time it helped.
Generative AI quietly demolished that assumption. The tells are gone. A phishing email written by AI is grammatically perfect, on brand, fluent in any language, and personalised to the recipient. It doesn't look wrong — it looks exactly right. The question for every business is no longer "can my team spot the typo?" It's "what do we do now that there is no typo?"
What AI Actually Changed
It's worth being precise. AI didn't create a new attack category — phishing is still phishing, still aiming to make you click a link, enter a password, or trust a request. What AI changed is the quality, personalisation, and economics:
Flawless writing, any language
The bad grammar that gave phishing away is gone. AI produces perfect, native-sounding text in any language — the typo era of phishing detection is over.
Personalisation at scale
AI mines your website, LinkedIn, news, and social posts to tailor each message — your name, role, projects, colleagues — for thousands of targets at once.
Near-zero cost per attack
Personalised spear phishing used to take an attacker real time. AI makes it nearly free, so small businesses once 'not worth it' are now profitable targets.
Convincing context
AI can reference a real recent event — a conference you attended, a vendor you use — making the message feel legitimately connected to your world.
Faster iteration
Attackers test and refine messaging continuously, learning what gets clicks and adapting in days, not months.
The economics point matters most for small businesses. Personalised spear phishing used to require an attacker to spend real time researching each target — so they reserved it for big payoffs. AI drops that cost to almost nothing. Now a small business that was never "worth" a tailored attack gets one anyway, generated automatically from its own public website and the team's LinkedIn profiles.
Why the Old Training Now Backfires
Training that taught people to scan for spelling mistakes and clumsy phrasing has a dangerous side effect in the AI era: it creates false confidence. An employee who's been taught "phishing looks wrong" sees a flawless, well-written email and concludes it must be genuine. The training designed to protect them now actively misleads them.
The fix isn't more typo-hunting. It's a different question entirely.
Interrogate the Request, Not the Writing
AI can perfect the writing. It cannot change what a phishing email fundamentally has to do: ask you to take an action that benefits the attacker. So teach your team to look past the prose and ask:
- What is this email actually asking me to do? Click, log in, pay, change a detail, share data?
- Where does the link really go? Hover and read the true destination — not the display text.
- Is the sender domain genuinely correct? Not the display name — the actual address.
- Does this fit a normal process? Or is it urgent, unusual, out of cycle, or routed around the usual steps?
Those questions work no matter how flawless the writing is — because they target the attacker's intent and mechanics, which AI can't disguise.
The Layered Defence That Still Works
- Advanced email security that inspects intent, sender authenticity (SPF/DKIM/DMARC), and link destinations — not spelling
- MFA on every account, so a phished password alone can't open the door
- Modern training focused on verifying requests and checking where links really go — not hunting for typos
- Out-of-band verification for any request involving money, credentials, or data changes
- External-sender banner warnings on inbound email
- Continuous phishing simulations that use realistic, AI-grade lures — not the obvious old ones
- 24/7 monitoring to catch credential theft and account takeover when a phish does land
- A fast, blame-free way for staff to report suspicious email
The encouraging news: technical email security has its own AI on the defensive side. Modern filters don't judge an email by its spelling — they assess sender authentication, link reputation, infrastructure, and behavioural anomalies. A perfectly written phishing email still fails those checks if it comes from a lookalike domain or points to a malicious link. The human layer and the technical layer cover each other.
The Bottom Line
AI phishing is the same wolf in a far better costume. You can no longer rely on it looking like a wolf. The defence shifts from appearance to substance: layered email security that inspects intent and infrastructure, MFA so a stolen password isn't game over, modern training that teaches people to verify requests rather than grade grammar, and monitoring to catch what slips through. The typo is gone — the process discipline has to replace it.
Related reading: AI-powered cyber attacks, deepfake business email compromise, and the phishing techniques targeting your team.
Frequently Asked Questions
How has AI changed phishing?
AI hasn't created a new kind of attack — phishing still tricks people into clicking links or sharing credentials. What AI changed is quality and scale: flawless grammar in any language, messages personalised from public data, and the ability to produce thousands of tailored emails at near-zero cost. The result is phishing that's far harder to spot.
Can you still spot AI phishing by looking for typos?
No — and that's the core problem. Generations of training taught people to look for bad grammar, awkward phrasing, and obvious errors. AI removes all of those tells. A modern phishing email can be perfectly written, on-brand, and contextually accurate. The old visual checklist no longer works.
Does AI phishing target small businesses?
Yes, more than ever. AI lowers the cost of personalised attacks to almost nothing, so attackers can profitably target small businesses they'd previously have ignored. Public data — your website, LinkedIn, press — gives the AI everything it needs to make a message feel tailored to you.
What still gives an AI phishing email away?
Not the writing — the intent and the mechanics. The request itself (urgency, a credential prompt, a payment change), the actual sender domain and link destinations, and whether it fits a normal process. Teach people to interrogate what an email is asking for and where it really leads, not how well it's written.
What's the best defence against AI phishing?
A layered approach: advanced email security that inspects intent, links, and sender authenticity rather than spelling; MFA so a stolen password isn't enough; modern training focused on verifying requests rather than spotting typos; and 24/7 monitoring to catch the attacks that get through.
Is Your Email Defence Ready for AI Phishing?
Free 30-minute assessment. We'll review your email security and training against AI-generated phishing.
Get Free Assessment