For years, the advice for spotting a scam email was simple: look for bad spelling and clumsy grammar. A real bank or supplier writes properly, so a message full of mistakes was probably fake. It was easy to teach, and for a long time it worked.

It doesn’t anymore. Scammers now use AI to write their emails, and AI writes cleanly. The typos and awkward phrasing are gone. The messages landing in inboxes from Laurel to Hattiesburg read as well as anything from a real company — and they can be written to sound like someone you already know.

Why the old advice stopped working

The spelling-and-grammar tell worked because many scammers were writing in a language that wasn’t their own, and the mistakes showed. AI took that away.

The UK’s National Cyber Security Centre says generative AI can now create convincing phishing lures “without the translation, spelling and grammatical mistakes that often reveal phishing.” The FBI says the same: criminals use AI to limit the errors that used to mark a message as fake. The one thing most people were trained to look for no longer tells you much.

Why these emails are so convincing now

  • The writing is clean. A scam email reads like a normal business email, because a machine wrote it in seconds, in whatever tone the attacker asked for.
  • It’s personal. Attackers can feed public details about your company into an AI tool — your website, your team’s LinkedIn profiles, a press release — and get a message with the right names, the right job titles, and a believable reason to be in touch.
  • There’s more of it. AI makes each message faster to produce, so attackers send far more. The FBI’s Internet Crime Complaint Center added a section on AI to its annual report for the first time, tied to more than 22,000 complaints and nearly $893 million in reported losses.

Today’s scam email isn’t “Dear customer, your account is suspended.” It’s a message to your bookkeeper that looks like it came from a supplier you really use, mentions a real project, and asks to update the bank details for the next invoice. It reads exactly like that supplier. The only thing wrong is that the supplier never sent it.

Your spam filter won’t catch them all

Email security catches a lot, and you should keep it switched on. But a well-written, personalized email that asks a normal-sounding question — with no obvious bad link or attachment — doesn’t always look dangerous to a filter. Both the NCSC and the FBI expect AI to push more of these messages through. The last line of defense is a person who knows what to check.

It’s not just email anymore

AI has done the same thing to phone calls and texts. The FBI warns that criminals can clone a voice from a short audio clip — enough for a voicemail that sounds like your boss or a family member asking for an urgent payment. The defense is the same: if a call or voicemail asks for money or logins, hang up and call the person back on a number you already have.

The warning signs that still work

If you can’t trust how an email is written, look at what it’s asking you to do. AI hasn’t changed these:

  • It asks for money, gift cards, or a payment to a new account.
  • It asks for a login, a verification code, or personal details.
  • It creates pressure: a deadline, a threat, or a “do this now.”
  • It asks you to change the bank details for an invoice or a supplier.
  • It comes with a link or attachment you weren’t expecting.
  • The display name looks right, but the actual email address doesn’t match.

Every one of these is about the request, not the writing. The rule to teach your team is simple: when a message is about money, logins, or how you pay someone, slow down before you act.

How to protect your team

  • Check money and login requests another way. If an email asks you to pay a new account or change a supplier’s bank details, call the person on a number you already have — not one from the email.
  • Retire the “watch for bad spelling” training. Teach staff to look at what the email is asking for.
  • Make one rule for payment changes: confirm every change to bank details by phone, even when it’s urgent.
  • Turn on phishing-resistant MFA or passkeys, so a stolen password is much harder to use even if someone gets fooled.
  • Make reporting easy. Nobody should feel silly for asking “is this real?”
  • Remind the team now and then. A five-minute huddle beats a poster nobody reads.

For Pine Belt offices that handle payroll, client trust accounts, or vendor payments — accounting firms, law offices, contractors, medical practices — that phone-verification rule is the single cheapest control you can add this week.

How West Computers Helps Your Team Catch Scams That Look Real

West Computers’ email security checks every incoming message for phishing, impersonation and business email compromise, including messages sent from a real account a scammer has taken over. Links are rewritten and checked again at the moment someone clicks, and suspicious attachments are opened in a sandbox before delivery. When a message is flagged, a banner explains why, so your staff learn the warning signs from real examples. In Microsoft 365, we enforce MFA so a stolen password alone isn’t enough, and our 24/7 SOC watches for the unusual sign-ins and inbox-rule changes that often follow a successful phish. To see how your inbox protection holds up, call (601) 425-0300 or visit westcomputers.com.

Frequently asked questions

Can you still spot a phishing email by bad spelling and grammar?
Not reliably. Attackers use AI to write clean, correct emails, so a message with perfect spelling can still be a scam. Judge it by what it asks you to do.

What are the warning signs that still work?
The request itself: paying money, changing bank details, sharing a login or code, or being pushed to act urgently. Those signs don’t depend on how the email reads.

Is AI-generated phishing really more effective?
Yes. The NCSC and the FBI have both warned that AI makes phishing more convincing and more personal, and the FBI has tied AI to tens of thousands of fraud complaints and hundreds of millions in losses.

Will my spam filter stop AI phishing?
It will catch a lot, and you should keep it on. But a well-written, personalized email with no obvious bad link can still look legitimate to a filter. A trained person is the backstop.

What should staff do if they aren’t sure about a message?
Slow down and check through a channel they trust — call a known number or ask the person directly. Then report it, even if it turns out to be genuine.

Article adapted with permission from The Technology Press.