AI PHISHINGTHE NEW TRAP.

An AI-written phishing email may have perfect spelling, a convincing tone and details that appear to prove it came from somebody who knows you. The old advice to look for bad grammar is no longer enough. A criminal can use modern AI tools to polish messages, imitate a company's writing style and tailor a story using publicly available information. The danger is the action they want you to take: opening a malicious attachment, revealing credentials, approving a payment or signing into a counterfeit website.

Phishing remains one of the most practical digital risks to prepare for. The UK's National Cyber Security Centre describes the core tactic as tricking people through messages, websites and calls into disclosing information or opening access to an attacker. Its 2026 guidance also recommends passkeys where available because they are resistant to common phishing attacks.

The defence is not to become an expert at judging whether prose was written by a machine. It is to check who is asking, what they want, and whether you can complete the legitimate task without trusting their link or attachment. This guide gives you a repeatable inspection routine and specific responses for the mistakes that can happen.

What is AI phishing?

Phishing is a scam designed to persuade somebody to hand over information, money or system access. AI phishing is not a separate crime with one technical definition; it is the use of AI to help create, personalise or run familiar social-engineering attempts. The incoming email might be entirely AI-generated, lightly edited or written by a human with AI assistance. You cannot tell the risk from the writing style alone.

Some attacks are broad: thousands of people receive a supposed parcel-delivery or tax-refund message. Others are targeted. Criminals may research an individual's role, employer, suppliers or social contacts and create a plausible request that fits their day-to-day work. An attacker could also send a message in the middle of an existing conversation if an account has been compromised.

Modern phishing can arrive by email, SMS, messaging apps, QR codes, social networks or search adverts. The medium changes, but the central decision does not: does this message require me to trust a route or instruction that I have not independently verified?

Why checking spelling and logos is no longer enough

Scam messages used to be identified by crude formatting and strange language. Some still have those flaws. But legitimate companies also make typos, and sophisticated scammers can produce polished wording and copied branding. A logo is just an image; a familiar name in the sender field can be manipulated; and an apparently normal link can lead somewhere unexpected.

Look instead for the underlying request. Does a delivery company truly need your banking password? Would your employer unexpectedly require an urgent transfer to a changed account? Why is a familiar service asking for a one-time sign-in code? These inconsistencies matter more than punctuation.

The NCSC's public reporting guidance is built around spotting unusual requests and protecting accounts. AI increases the value of that approach because the surface appearance of a message is less useful as a filter.

Seven checks before opening a suspicious email

You do not need specialist software to perform these checks. Use them especially when an email asks you to sign in, transfer money, open a file or make a consequential change.

The aim is to interrupt the fraud before the consequential action. A message does not become safe because it passed six of the seven checks; one confirmed mismatch may be enough to reject it.

How to inspect an email address and link safely

First, expand the sender details to see the full address. A display name such as “Accounts Department” is not proof of an organisation. Compare the domain with the address the organisation actually uses. Similar-looking characters, extra words and unfamiliar subdomains can be deceptive.

Second, consider the link. On a desktop computer you can often hover over a link to preview its destination without opening it. On a phone, link previews may be less obvious, and long-pressing can produce accidental actions depending on the app. Do not click a suspicious link just to investigate where it goes.

Even a link that appears to use a legitimate domain needs context. An attacker might compromise an account, abuse a redirect or place malicious content in a site that otherwise looks genuine. If the message claims you need to log in, navigate separately to the company's official app or a bookmark you created yourself.

For example, an email claiming your bank account is suspended may point to a page that perfectly imitates the bank. Rather than inspecting every design detail, open the bank's app independently and check whether it actually shows a security notice. If uncertain, call the number printed on your card.

AI phishing scenarios worth recognising

A convincing parcel-delivery message

The message names a familiar courier, includes a plausible tracking style and says a small payment is needed to release a parcel. You were expecting a delivery, so the timing feels persuasive. The safer response is to check the order through the shop or the courier's real app rather than following the message's payment route.

A supplier asks for changed bank details

A business receives an email appearing to continue a real conversation with a supplier. The message says future invoices must be paid to a new account. This could be ordinary administration, but the potential loss is large. Confirm the change using an established telephone contact, not the phone number supplied in the email itself.

A colleague shares an urgent document

A worker receives what looks like a familiar colleague's file-sharing invitation. The link opens a login form and asks for an additional code. If the document was unexpected, confirm through a separate channel. A familiar sender account can itself have been compromised.

A fake security alert

The email claims suspicious activity has been detected and tells you to reset your password immediately at an embedded link. That creates a clever trap: the supposed security step may steal the password. Visit the service directly, check recent activity and make changes inside its genuine settings.

For how impersonators can use a familiar voice as well as a familiar email account, see AI Voice Scam: Verifying a Loved One's Call.

Are AI-written phishing emails harder to detect?

They can be more convincing because attackers can correct grammar, adjust tone, translate messages and incorporate details about a target. However, the apparent fluency of a message cannot prove it was AI-generated. Some highly effective attacks are entirely human-written, and the safest response does not depend on establishing authorship.

Look for behavioural pressure: is the sender trying to move you away from a trusted process? Are they asking you to approve access or payment in an unusual way? Would refusing to act for five minutes genuinely create an emergency, or is that claim being used to rush you?

A well-written email asking you to send your password is still suspicious. A poorly written but authentic account notice may be genuine. The source and requested action are what matter.

What about QR codes and text-message phishing?

A QR code can hide a web destination behind a pattern that is harder for a reader to inspect. Some scams put one in an email or paper notice and encourage the recipient to scan it to “verify” an account. Treat the code as a link supplied by an untrusted sender. If the request concerns a known organisation, open its official app or website independently.

Texts can also appear in an existing message thread associated with a real service. That does not by itself confirm the new message's authenticity. In the UK, most mobile providers support forwarding suspected scam texts to 7726, according to NCSC instructions. For emails, the NCSC's Suspicious Email Reporting Service uses report@phishing.gov.uk (official instructions here).

If a text claims a bank transfer is pending, use the bank's normal app or independently sourced number. Never reply with a one-time code or card PIN.

Why passkeys are a particularly useful defence

One of the strongest 2026 improvements in everyday account security is the availability of passkeys. A passkey uses cryptographic credentials linked to the correct service, rather than a reusable password that can be typed into a fake sign-in page.

In April 2026 the UK NCSC published an analysis comparing FIDO2 credentials with traditional multifactor authentication. It concluded that properly implemented passkeys are resistant to common credential-phishing techniques and recommended choosing them where supported.

That does not mean a passkey makes an account impossible to compromise. Device security, recovery procedures, phishing for other details and scams that persuade you to authorise a payment still matter. A passkey protects an authentication pathway; it does not assess whether an email's business request is sensible.

Use passkeys for critical accounts where available. Otherwise use strong unique passwords, a password manager and two-step verification. Protect the main email account particularly carefully because it is the recovery route for many other services. See What to Do After a Data Breach for the corresponding recovery plan.

What to do if you already clicked a phishing link

The correct response depends on what you actually did. Opening a web page without entering information is different from uploading a sensitive file, entering a password or installing a program. The NCSC's incident-response guidance makes these distinctions.

Do not delete evidence or attempt improvised technical repairs if your workplace security team needs to investigate. If you suspect malware is actively controlling a device, use a different trusted device to secure critical accounts and seek appropriate technical help.

How to report AI phishing and fraud

In the UK, suspicious emails can be forwarded to report@phishing.gov.uk and suspicious texts commonly to 7726. If you have lost money or been a victim of fraud, contact your bank first and report it to Report Fraud in England, Wales and Northern Ireland; Scotland uses Police Scotland. Report Fraud replaced Action Fraud in December 2025.

If you are elsewhere, use the relevant national reporting service and financial provider. The US FTC's consumer fraud guidance recommends independently contacting organisations rather than using details supplied in the suspicious message.

Reporting can help services investigate campaigns, but it does not itself secure a compromised account. Complete any necessary password, payment and device protection steps separately.

A ten-minute phishing drill for your household

1. Choose a harmless example of a scam message from an official awareness resource; do not open a live suspicious link.
2. Identify the sender's claimed organisation, the action requested and the pressure being used.
3. Show how to find the organisation's genuine app or contact page without following the message.
4. Find the email account's security settings and check whether passkeys or two-step verification are enabled.
5. Practise forwarding a sample description—not a real victim's private information—to the correct reporting service.
6. Write down one action you will always verify independently, such as a changed bank account or unexpected sign-in request.

Repeat the drill with an older relative or anyone who receives many unfamiliar messages. The goal is a simple habit, not a perfect ability to identify every manipulated message visually.

The bottom line

AI makes phishing more persuasive, but it does not change the essential weakness attackers exploit: getting someone to trust a message and act before verifying it. You need not prove an email was generated by AI to stop the fraud.

When a message asks for access, money, credentials or an unusual change, leave the message and verify through a route you control. Pair that habit with strong authentication and a clear recovery plan.

Frequently asked questions

Can AI write phishing emails without spelling mistakes?

Yes. Modern AI can produce fluent, well-formatted text. Grammar is therefore a weak way to judge whether a message is legitimate.

How can I check a suspicious email without opening its links?

Inspect the sender and request, then visit the claimed service using an independently saved bookmark, official app or known phone number. Do not use the link or number supplied in the message.

What is the best protection against phishing passwords?

Where supported, passkeys provide strong resistance to common credential phishing. Use unique passwords and two-step verification on services without passkeys, and keep devices and recovery methods secure.

What if I clicked a phishing link but did not enter anything?

The NCSC says further action may be unlikely to be necessary if you entered no information and did not download or install anything, though it remains sensible to watch for suspicious activity.

Where can I report a scam email in the UK?

Forward suspected phishing emails to report@phishing.gov.uk. For actual fraud or financial loss, contact your bank and use Report Fraud, or Police Scotland where applicable.

Sources and further reading

• UK NCSC — Phishing Scams: How to Spot and Report Them.
• UK NCSC — Comparing Passkeys and Traditional Credentials (2026).
• UK NCSC — Phishing Incident Response.
• UK NCSC — Report a Scam Email.
• UK NCSC — Report a Scam Text.
• Report Fraud — UK Police Reporting.

Research reviewed 6 November 2026. Examples are illustrative, not reports of particular victims. Follow your employer's incident process where a work account is involved.