The advice most of us learned about spotting phishing was built for an era that has ended. Look for bad grammar, odd phrasing, a generic greeting. That guidance worked because writing a convincing email in fluent business English, at scale, used to be the hard part of the job. It isn’t any more.
Generative AI has removed the two constraints that used to limit phishing: fluency and effort. What follows is what actually changed, and what still works for catching these when the old signals no longer apply.
What Actually Changed
The language tells are gone
Awkward grammar was never a deliberate filter; it was a limitation. A language model produces clean, idiomatic business English on the first attempt, in any language, at no cost. Training staff to look for spelling mistakes now teaches them to trust well-written messages, which is the opposite of what you want.
Personalization scaled
Targeted phishing used to require manual research, so it was reserved for high-value targets. Public information — a LinkedIn profile, a company news page, a conference agenda, a press release about a new client — can now be assembled into a personalised pretext automatically. An email referencing your actual role, your actual manager and a project that genuinely exists is no longer evidence of a determined attacker. It’s the default.
Voice and video joined the toolkit
Cloning a voice now takes seconds of public audio, which means a phishing email can be followed by a confirming phone call in a familiar voice. We covered this separately in how to spot a deepfake scam.
Rule-based filtering lost ground
Email filters built around known-bad phrases, templates and sending patterns work less well when every message is unique. Filtering still matters and still catches a great deal — but it has shifted toward behavioural signals, sender reputation and detecting counterfeit login pages rather than matching text.
What Still Works
Here is the useful part: AI improved how convincing the message is. It did not change what the attacker ultimately needs you to do. Every one of these attacks still ends in the same small set of actions, and those are what to train on.
- Enter your password somewhere. However persuasive the message, the credential still has to be typed into a page the attacker controls. A password manager helps here, because it will not auto-fill on a domain that does not match — see choosing a password manager.
- Approve a login you did not start. If an authentication prompt arrives when you weren’t signing in, that is someone else holding your password. Deny it and report it.
- Move money or change payment details. Verified by callback to a number you already have, never one supplied in the message.
- Act before checking. Manufactured urgency is still the engine. A fluent, personalised email that needs something done before you can verify it is the same attack it always was, better dressed.
The shift in training is from spot the fake to verify the request. Judging authenticity by how a message reads is no longer a skill anyone can reliably apply. Confirming an unusual request through a second channel is a habit anyone can follow.
Our guide to spotting phishing in email, Teams and fake IT support messages walks through the current tactics in plain language, including adversary-in-the-middle attacks that defeat some forms of multi-factor authentication. It is free to share with your team.
The Controls That Carry the Weight
Because the message itself can no longer be judged reliably, more of the burden shifts onto controls that do not depend on human judgment at all:
- Phishing-resistant multi-factor authentication. Hardware security keys using the FIDO2 standard do not work on a counterfeit domain, which makes them resistant to attacks that defeat codes and push approvals.
- Conditional access that questions sign-ins from unfamiliar devices and locations, as covered on our SASE and Zero Trust page.
- Monitoring of identity activity — impossible-travel logins, new mail-forwarding rules, unexpected permission changes — through managed detection and response, so a successful phish is caught in minutes rather than months.
- A verification procedure for payments that exists in writing, so following it is normal rather than an implied accusation.
Common Questions
How can you tell if a phishing email was written by AI?
Generally you cannot, and it does not matter. A well-written message is no longer evidence of legitimacy, and a badly written one is no longer the main signal of fraud. The practical question is not who or what wrote it, but whether the request can be verified through a channel you already trust.
Is security awareness training still worth doing?
Yes, but the content has to change. Training built around spotting typos and generic greetings now actively misleads people. Effective training today focuses on verification habits, on recognising the request types attackers need, and on making it socially comfortable to pause and check.
Does multi-factor authentication still protect us?
It remains one of the most valuable controls available, and not all forms are equal. Codes and push approvals can be defeated by adversary-in-the-middle attacks that relay your login in real time. Hardware security keys are resistant to that because they will not authenticate against a counterfeit domain.
Where to Start
At North Star, we help Denver-area businesses update security awareness training to reflect how phishing actually works now, rather than relying on advice that has quietly expired. Training and phishing simulation sit within our managed security services, alongside the identity and email controls that catch what people should not have to catch themselves. For businesses without an IT department, it comes as standard with small business IT support.
If it has been a while since your team’s training was refreshed, a security assessment will tell you where you actually stand. Get in touch or call us at 303-552-0018.
