How generative AI changed phishing: perfect emails, zero mistakes

For years, the number one piece of advice against phishing was simple: be suspicious of email with spelling mistakes, odd formatting or a badly done translation. That advice still holds — but less and less. Since late 2022, security researchers have recorded a 1,265% increase in malicious phishing emails, coinciding directly with the popularization of generative AI tools capable of writing fluent text in any language.

What changed, in practice

Why is AI-generated phishing more dangerous?

Generative AI tools eliminate the grammar errors and awkward tone that historically gave phishing away, producing emails with a professional tone, clear structure and natural language — making the scam much harder to spot at first glance. A study comparing phishing emails written by humans and by ChatGPT found click rates of up to 81% on the AI-generated ones — practically equivalent to, or even better than, those written by experienced scammers.

What generative AI can automate in the attack

• The email copy — tone, formality and vocabulary tuned to the context (bank, HR, supplier), without the errors that used to give away sloppy machine translation.
• Personalization at scale — with public data about the victim (LinkedIn, social media), AI can generate variations of the same scam addressed to hundreds of different people, each one looking tailor-made.
• Site cloning — fake login pages visually identical to the originals, generated quickly from the real site's public source code.
• Code obfuscation — malicious scripts automatically rewritten to slip past filters based on known signatures.

That complete package is exactly what tools like WormGPT and FraudGPT sell as a service on the dark web — phishing as a product, requiring no technical knowledge from the buyer.

The signs that still work (and the ones that stopped working)

Stopped working as a standalone indicator: spelling mistakes, robotic translation, broken formatting. A well-written email is no longer a guarantee of legitimacy.

Still work:

• Sender domain — checking the full address, not just the display name, remains the most reliable test.
• Artificial urgency — "your account will be blocked in 24h", "confirm now or lose access" — a psychological manipulation pattern that AI does not eliminate, because it's part of the scam's strategy, not a writing mistake.
• Link doesn't match the text — hovering over the link (without clicking) and comparing it to the displayed text still exposes a good share of attempts.
• An out-of-pattern request — a request for sensitive data, a password or a payment through a channel the company doesn't normally use.

These signs complement what we already covered in the general guide on how to spot phishing by email — the difference now is that "badly written text" has dropped off the priority list.

Authentication is still the safety net

Even with a perfect email and a login page identical to the original, the scam only succeeds if the victim actually types the password in the wrong place. Enabling two-factor authentication drastically reduces the damage even when the phishing works — because the criminal still needs the second factor, which normally isn't available to someone who only stole the password. See how to set it up in the two-factor authentication guide.

Defense shifted from text to context

The practical conclusion is that writing quality is no longer a reliable security criterion. What remains reliable is asking: was I expecting this email? Does the sender match the official domain exactly? Is there artificial time pressure? If the answer to any of those is "no" — or "yes" in the wrong direction — the well-written email deserves more suspicion, not less.