A few years ago, phishing emails were often easy to spot. Broken grammar, awkward phrasing, a sender name that didn't quite match the company. These were reliable tells. That's changing. Large language models can now write fluent, context-aware, perfectly punctuated messages in seconds, and that has quietly removed one of the oldest and most reliable red flags people were taught to look for.
This doesn't mean phishing has become undetectable. It means the signs have shifted from "how it's written" to "what it's asking and how it arrived."
What AI actually changed
Before, catching phishing often meant catching a mistake: a typo, an odd sentence structure, a generic greeting where a real colleague would use your name. AI-generated messages don't make those mistakes. A model can be given a company's tone, a target's job title, and recent public information, and produce a message that reads exactly like something a real coworker or vendor would send.
What AI has not changed is the underlying goal of a phishing message: get you to act quickly, click something, or hand over information you wouldn't normally hand over. That goal still has to show up somewhere in the message, and that's where it remains visible.
What still gives it away
- The request still doesn't match the relationship. A vendor you've never paid by wire transfer suddenly asking for one. A manager who always calls for anything urgent instead sending only an email. AI can perfect the writing style, but it usually doesn't know your actual working relationships and history.
- Urgency is still doing the work. Well-written or not, a message engineered to make you act before you think is still built around urgency. That pressure is the tell, not the grammar.
- Verification still breaks the illusion. A well-written email cannot survive a phone call to a number you already had on file. AI can generate convincing text; it can't fabricate a real answer to a question only the actual sender would know.
- The channel is often wrong. A "CEO" messaging from a personal number over text, a "bank" emailing instead of using their secure app inbox. The polish of the message doesn't fix an inappropriate channel.
A practical shift in habit
The old habit was: read carefully, look for mistakes. The new habit needs to be: read the request, not just the writing. Ask what the message wants you to do, whether that request matches how this person or organization normally communicates with you, and whether you can verify it through a channel the message itself didn't provide.
AI has made the surface of phishing more convincing. It hasn't changed what phishing fundamentally needs from you: a fast, unverified reaction. Slowing down by even thirty seconds to check the request against what you already know is still the most effective defense there is, regardless of how well the email is written.