The spelling mistakes are gone and the voice on the phone can be cloned — but a handful of calm checks still catch almost every fake.

For years, spotting a scam email was a game: find the clumsy spelling, the "Dear Customer" greeting, and delete it. That game is over. AI writes the scammer's messages now, and it writes them beautifully. The good news: the trick underneath has not changed. A phishing message still has to make you do something — click, pay, log in, hand over a code — and that request is where it gives itself away.

What AI actually changed

Three things are different in 2026. First, the language is flawless. The UK's National Cyber Security Centre (NCSC) notes that scams used to betray themselves with bad spelling and design that felt "off" — but they are getting smarter, and some now fool the experts.

Second, the lure is personal. Instead of blasting one fake invoice to a million strangers, scammers can fold in public details — your name, your job, a trip you posted about — so the message reads like it came from someone who knows you.

Third, phishing has a voice now. The US Federal Trade Commission (FTC) warns that a scammer can clone a loved one's voice from a short audio clip — the kind anyone might post online — plus a voice-cloning program. The call sounds exactly like your son or manager: panicked, in trouble, in a hurry. And as CISA notes, caller ID can be spoofed, so a familiar number on screen proves nothing.

The checks that still work on emails and messages

Look at the real sender address, not the display name. CISA warns that phishing senders imitate real businesses by altering or dropping a few characters in the address. The domain after the @ is what counts; a lookalike domain is a failed test.

Check where links really go. On a computer, hover before you click: CISA notes that spoofed links reveal a destination that does not match the text, and fake sites copy the real one while changing the spelling or ending. On a phone, press and hold to preview. If the address looks wrong, close it.

Interrogate the request, not the writing. The FTC lists the stories phishing tells: suspicious activity on your account, a billing problem, a request to confirm personal information, an invoice you do not recognise, a link to make a payment, a government refund, a coupon for free stuff. A polished version is still one of these stories. And apply the NCSC's pressure test: scammers push you to act without thinking. Urgency is not a feature of honest admin — it is the sound of the trap closing.

Treat unexpected attachments as hostile. An attachment you were not expecting is one of CISA's classic warning signs — especially one with a reason you must open it now.

The one habit that defeats voice calls: verify separately

For calls, the FTC's advice fits in one sentence: don't trust the voice. Hang up and call the person back on a number you already know is theirs; if you cannot reach them, check via another family member. A real emergency survives a five-minute delay; a scam usually does not.

Two reinforcements: Agree a family code word — a word only your household knows, never posted anywhere. A clone can copy how someone sounds; it cannot know what was never said online. And watch the payment request: the FTC flags wire transfers, cryptocurrency, and gift cards with the numbers and PINs read aloud as classic scam signs.

Companies get the same treatment. The FTC's test: do I have an account with this company, or know this person? If no, report and delete. If yes, contact the company via a number or website you know is real — never the details in the message.

Make a stolen password useless

Checks fail sometimes, so build the second wall now. Turn on multi-factor authentication, and where a service offers a passkey, take it: CISA describes FIDO-based authentication — the technology behind passkeys — as the strongest form of MFA, because the login is tied to the real website and cannot be typed into a fake one. A password manager helps twice over: every account gets a different password, and it will not autofill on a lookalike domain, because the address does not match. Finally, follow two of the FTC's basics: keep software set to update automatically, and back up your data.

Your 60-second checklist

1. Pause. Urgency is the weapon — slow down.
2. Check the sender's real address — display names and caller ID can be faked.
3. Do not click, tap, scan or open anything in the message.
4. Ask: was I expecting this? Is the request unusual — money, a code, a password, secrecy?
5. Verify on a separate channel: the official app, the number on your bank card, or a call back to a saved contact.
6. If it fails any check, report and delete it — never reply or use its "unsubscribe" link.

Report it — it protects the next person

Reporting is quick — providers use reports to block senders and take down fake sites. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward scam texts to SPAM (7726), and report attempts to the FTC at ReportFraud.ftc.gov. In the UK, forward suspicious emails to the NCSC's reporting service at report@phishing.gov.uk.

AI has made fakes prettier and more personal. It has not made them patient, and it has not given them your bank's real app or a code word whispered at home. Verify separately, and the illusion collapses.

Sources

• CISA, "Avoiding Social Engineering and Phishing Attacks"
• US Federal Trade Commission, "How to Recognize and Avoid Phishing Scams"
• US Federal Trade Commission, "Scammers use AI to enhance their family emergency schemes," 20 March 2023
• UK National Cyber Security Centre, "How to spot scammers claiming to be from the NCSC," 30 June 2023 (updated 20 August 2026)

Related reading: Passkeys and Two-Factor Authentication: Stronger Sign-Ins in 15 Minutes · Was Your Email in a Data Breach? How to Check Safely