Home › Knowledge Hub › AI-written phishing
AI-written phishing: why the old 'look for bad grammar' advice stopped working
The advice to spot a scam by its bad spelling is finished. Generative AI now writes phishing emails, texts, and messages in fluent, professional language, in any tongue, at scale. The reliable tells were never really about grammar. They are about who contacted whom, what is being asked, and whether you can verify it through a channel the sender does not control. This guide gives you the checks that still work.
For years the standard advice was simple: scam messages are full of spelling mistakes and broken grammar, so trust your instinct when something reads wrong. That advice built a habit that now works against you, because the thing it keyed on has disappeared.
Why the messages read so well now
Generative AI writes clean, confident prose on demand. A scammer can now produce a flawless email in the house style of a bank, a fluent text in your language, or a convincing support reply, in seconds and in volume. The same tools translate perfectly, so the "obviously foreign" tell is gone too. The message that would once have raised your guard with a clumsy sentence now reads exactly like the real thing.
The FBI's Internet Crime Complaint Center recorded roughly 893 million dollars in losses to complaints that specifically involved AI-enabled fraud in 2025, a category it had only just begun counting. Polished text is one part of that; cloned voices and faked video are others.
So the surface no longer tells you anything. You have to judge the message by what does not change when the writing improves.
Check the request, not the writing
Every phishing message, however well written, is trying to make you do one of a small number of things. The request is the tell.
- Move money, or pay a fee. A real organisation you already deal with does not create sudden, urgent payment demands out of the blue.
- Hand over a credential. Passwords, one-time codes, 2FA approvals, card details, or your crypto seed phrase. No legitimate party ever needs these, and your seed phrase protects everything you hold.
- Move to a private channel. "Continue on WhatsApp or Telegram" pulls you somewhere with no record and no protection. Honest support does not do this.
- Act under a deadline. Urgency exists to stop you pausing to check. The clock is the manipulation.
If a message asks for any of these, treat it as hostile until proven otherwise, no matter how clean the prose.
Check the direction of contact
The single most durable question: did they contact you, or did you contact them? Scams almost always begin with inbound contact you did not initiate, a message, a call, a DM, that then steers you. A support agent who messages you first, a "fraud department" that calls you, a recruiter or investor who slides into your DMs, all start from the same place. You cannot un-write that with good grammar.
Verify out of band
The one check AI cannot defeat is verifying through a channel the sender does not control.
- Do not click the link or call the number in the message. Open the app, or type the official address you already know, yourself.
- If "your bank" or "your exchange" contacts you, reach them back through the number on your card or their official site, not the details they gave you.
- If a person you know sends an urgent, unusual request, confirm it on a different channel. This is the same defence as for AI voice-cloning calls.
A message that cannot survive independent verification is the answer, whatever it looked like.
Links and domains still matter
AI writes the words, but it cannot give the scammer the real domain. Check where a link actually goes before you click: hover or long-press to see the true address, and look for look-alike spellings and wrong top-level domains. Our guide on cloned websites and fake social proof covers how convincing the destination can look once you arrive.
Red flags that survive good writing
- The message contacted you first and is steering you somewhere
- Any request for a password, one-time code, 2FA approval, or seed phrase
- A push to move the conversation to WhatsApp, Telegram, or another private app
- Urgency, a countdown, or a threat if you do not act now
- A link whose real domain does not match the organisation it claims to be
What this guide cannot do
It cannot give you a single visual tell, because the reliable ones were never visual. What it can do is move your judgement from how a message reads to what it asks and whether you can verify it, which is the only ground that holds now that anyone can generate a perfect message.
This is general information, not legal or financial advice.
If you acted on a message you now suspect, use Chain Pursuit's free tools to understand your options and preserve evidence. Never share your seed phrase, private keys, passwords, or one-time codes with anyone.
Sources
Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf, which reports losses to complaints involving AI-enabled fraud, including generated text, voice, and video.
Cybersecurity and Infrastructure Security Agency, Teach Employees to Avoid Phishing. https://www.cisa.gov/secure-our-world, guidance that verification and the nature of the request, not spelling, are the reliable defences against phishing.
Federal Trade Commission, How To Recognize and Avoid Phishing Scams. https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams, on verifying through known, independent channels rather than details supplied in the message.
The 893 million dollar figure is the AI-enabled fraud total reported by the IC3 for 2025; the structural tells described here are consistent across the CISA and FTC guidance above. Reviewed quarterly.
Frequently asked questions
Isn't bad spelling still a sign of a scam?
It can be, but good spelling is no longer a sign of safety. Generative AI writes fluent, professional messages in any language, so the absence of errors proves nothing. Judge the request and the channel instead.
What is the most reliable way to catch a phishing message now?
Ask who started the contact and verify out of band. If the message reached you first and asks you to pay, log in, share a code, or move to a private app, check by opening the app or calling the official number yourself, not the one in the message.
Can AI fake the sender's email address or the link too?
A scammer can spoof a display name and build a convincing look-alike domain, but not the genuine official address. Always check where a link really goes, and reach organisations through the contact details you already know.
They moved the conversation to WhatsApp. Is that a problem?
It is a warning sign on its own. Legitimate banks, exchanges, and support teams do not move you to WhatsApp or Telegram. Private channels remove the record and the protections, which is exactly why scammers want you there.
A message used my name and real details. Doesn't that make it genuine?
No. Personal details are cheap, often from breaches or your public profiles, and AI stitches them into a convincing message. Accurate details raise the quality of the scam; they do not verify the sender.
My "bank" emailed asking me to confirm a code. Should I?
No. No legitimate bank or exchange asks you to share a one-time code, password, or 2FA approval. Do not reply or click. Contact the bank through the number on your card to check.
Think a message you received was a scam?
Eleven questions that show what to do next and how to preserve the evidence, with no email required.
Check my case