Spot AI-Generated Phishing Emails and Messages

Updated 8 November 2026 · Standard formula, shown below

AI can help scammers write fluent, personalized messages, so spelling and grammar alone are no longer reliable warning signs. Use the checks below to assess suspicious email, text, or chat messages before you click, reply, open an attachment, or share information; you will need access to the message and a separate trusted way to verify its claims.

What You’ll Need

The original message, including its sender details and any links or attachments. Do not open suspicious links or files to inspect them.
A known-good contact route, such as a phone number from a payment card, official app, saved contact, or address you already trust.
Access to your email or messaging app’s report-phishing and block-sender controls, if available.
If this is a work or school account, the organization’s security or IT reporting channel.

Step-by-Step

Pause before acting. Do not click, tap, reply, download, scan a QR code, or call a number supplied in the message. Urgency is often used to make people skip checks. A message can be dangerous even if it looks polished, uses your name, or appears to come from someone familiar.
Identify what the message wants. Look for requests to sign in, confirm a password, pay an invoice, buy gift cards, transfer money, share a verification code, change bank details, or open a file. Treat unexpected requests for credentials, payment, sensitive data, or secrecy as high risk. A familiar-looking request still needs independent verification.
Check the sender address or account, not just its display name. In email, expand or open the sender details and inspect the complete address. Watch for misspellings, extra words, unusual domains, or a reply-to address that differs from the sender. In text and chat, check the full number, username, or account identity when the service shows it. Display names, logos, profile pictures, and caller ID can be copied or spoofed, so none proves who sent the message.
Inspect links without visiting them. On a computer, hover over a link to reveal its destination; on a phone, press and hold only if your device safely shows a preview without opening it. Check the actual domain from right to left: the registered domain is generally the part immediately before the ending such as .com or .org. For example, a name like secure.example.com is under example.com, while example.com.attacker.invalid is under attacker.invalid. Be wary of misspellings, unrelated domains, shortened links, or addresses that use a brand name only as a subdomain. When in doubt, go to the service through its saved app or a known address instead.
Compare the request with what you know. Does the timing, amount, project, invoice, travel, or account activity make sense? Check previous messages or records you already trust, but do not use contact details or links from the suspicious message. If it claims a colleague or family member needs urgent help, contact them through a saved number or a separate, established conversation.
Look for inconsistencies, not just bad writing. Check whether the sender’s identity, greeting, signature, tone, and requested action fit the relationship and normal process. Notice odd details such as an unexpected change in payment instructions, a generic greeting paired with supposedly private knowledge, or an unusual demand for secrecy. AI-written messages may have excellent grammar and convincing context; odd phrasing can be a clue, but fluent writing is not proof of legitimacy.
Verify through a separate trusted channel. Open the organization’s official app or type a known website address yourself. For a payment, account warning, or workplace request, contact the relevant person or department using a previously verified number or directory entry. Ask whether they sent that specific request. Do not reply to the message or use its phone number, email address, or link to verify it.
Report and remove a message you cannot verify. Use the app’s phishing or junk-report feature, or forward it to your organization’s designated security contact. Follow workplace reporting procedures before deleting it, since staff may need the message for investigation. After reporting, block the sender if appropriate. Do not forward suspicious material to others as a warning unless your security team directs you to.
If you already interacted, limit the damage promptly. If you entered a password, use the genuine service’s app or typed-in address to change it, and change it anywhere else you reused it. Turn on multifactor authentication if available, review active sessions and sign out unknown ones, and contact the service through a trusted route. If you shared a one-time code, payment details, or money, contact the affected provider or financial institution immediately and report the incident to your organization’s security team when applicable. Do not send more codes or payments to someone claiming they can recover your account or money.

Common Mistakes

Trusting polished writing. AI can produce natural language, and people make typos too. Writing quality is only one small clue.
Assuming a familiar name or logo is proof. Sender names, images, and conversation screenshots can be copied. Verify the actual account and request independently.
Clicking to see whether a link is real. A page may collect credentials or trigger a download. Use a trusted app or manually enter a known address instead.
Replying to ask if it is genuine. A scammer can simply confirm it. Contact the supposed sender using details you already trust.
Relying on one warning sign. A message with no spelling errors can be fraudulent; an awkward message may be legitimate. Consider the sender, request, destination, and verification together.
Assuming spam filters catch everything. Filters reduce unwanted messages but cannot guarantee that every phishing attempt is stopped.

Tips

Set a personal rule: never approve an unexpected payment, password reset, or request for a verification code solely from a message.
Use multifactor authentication and unique passwords. These steps do not make phishing harmless, but they can reduce the impact of a stolen password.
For work, agree on a known process for changing supplier bank details, approving transfers, and reporting suspicious messages. Confirm changes with a second, previously verified contact route.
Preserve the message if your security team needs it. Email headers and the original message can help investigators; a screenshot alone may omit useful details.
Be cautious with unexpected attachments and QR codes too. A QR code is simply another way to hide a link; check the destination before proceeding.

Troubleshooting

The sender appears to be someone I know. Their account may be compromised, or their identity may be imitated. Do not use the message’s reply button to verify. Contact them through a saved number or another established channel and ask about the exact request.

I cannot tell whether a link is safe. Do not open it to find out. Visit the service from its official app or a bookmark you created earlier, or contact its support using details from a trusted source. If the message is work-related, send it to your security team for review.

I opened a link but did not enter anything. Close the page and do not download files or accept prompts. If a file downloaded or you approved a notification or login prompt, tell your IT or security team. On a personal device, use its built-in security tools and check for unfamiliar downloads or app installations.

I entered credentials or shared a code. From a trusted device and genuine site or app, change the affected password immediately, revoke unfamiliar sessions, and secure any accounts that reused it. Contact the service provider or workplace security team. A verification code can authorize access or a transaction, so report its disclosure even if you did not share your password.

I sent money or payment information. Call the bank, card issuer, payment service, or organization involved using a verified contact route as soon as possible. Explain that the payment may be fraudulent and follow its instructions. Save the message and transaction details, and report the incident to the appropriate workplace or local authorities if applicable.

Frequently Asked Questions

Can you identify an AI-written phishing message by its wording?
No. AI-written messages can be fluent or awkward, and legitimate messages can have either style. Verify the sender, destination, request, and context instead.

Does a correct name or personal detail mean the message is genuine?
No. Scammers may find details in public sources, previous breaches, or compromised accounts. Personalization is not authentication.

Is an email safe if it passes spam filters?
No. Filters can miss phishing, including targeted messages. Apply the same checks to messages that reach your inbox.

Should I forward a suspicious message to someone else?
Use your email or service’s report feature, or follow your organization’s instructions. Forwarding it casually can expose others to the link or attachment and may remove useful message details.

What if a message says my account will be closed today?
Do not follow its link or call its number. Open the service’s official app or type a known address yourself and check for an alert there; contact support through trusted details if needed.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.