Stopping AI-powered attacksBeginnerLesson 1274 min read

AI-written phishing at scale

Phishing emails no longer have spelling mistakes. Learn what to check instead: the sender, the request, the pressure and where the link really goes.

✦ Ask the tutor🧪 Lab · 25 min📝 Lesson test
Lesson in motion

In 60 seconds

AI-written phishing at scale

Phishing emails no longer have spelling mistakes. Learn what to check instead: the sender, the request, the pressure and where the link really goes.

1/6
In simple words
A fake letter used to have spelling mistakes, so it was easy to catch. Now a robot fixes the spelling. So we stop checking the spelling and start checking the envelope: who really sent it, and what are they asking you to do?
Phishing is a message that pretends to be from someone you trust, to make you click, log in, pay or share. Spear-phishing is phishing aimed at one person or team, using details about them.

Why the old signals fail

Old advice
  • Look for spelling and grammar mistakes
  • Scams are generic: "Dear customer"
  • Scams come in poor English
  • Look for a blurry logo
What is true now
  • AI writes clean, natural text
  • Messages use your name, role and real projects
  • They arrive fluent in any language
  • Logos and signatures are copied exactly

Spear-phishing from public information

An attacker can collect your job title from LinkedIn, your manager's name from the company website, and a vendor name from a press release. AI turns this into a message like: "Hi Priya, following up on the audit Rahul mentioned. Please review the updated report before Friday." It feels normal because the details are real.

QR-code phishing

Some phishing puts the link inside a QR code, in an email, a PDF or even a printed poster. People often scan with their phone, which may have fewer protections than the work laptop, and the link is hidden until you scan it. Treat a QR code like any other link.

What to check instead

  1. 1

    Sender address

    Look at the real email address, not the display name. Watch for lookalike domains, such as one extra or swapped letter, or a different ending.
  2. 2

    The request

    Is it asking for a login, a code, a payment, bank changes, a file, or access? Those need extra care.
  3. 3

    The pressure

    Urgency, secrecy, fear or flattery are signs to slow down.
  4. 4

    The link destination

    Hover (on a computer) or long-press (on a phone) to see the real address. Better still, go to the site yourself instead of clicking.
  5. 5

    Is it expected?

    Were you expecting this invoice, document or password reset? If not, verify through a known channel.

A quick look at email headers

Every email carries hidden headers that record where it came from. Most mail apps have an option like "Show original" or "View source". Three checks there are useful: SPF (was it sent from a server the domain allows?), DKIM (was it signed by the domain?), and DMARC (do these match the domain shown in "From"?).
Watch out
A "pass" only means the email really came from that domain. An attacker who registers a lookalike domain can pass all three checks. Always ask: is this the domain I actually know?

Reporting

Use your organisation's "Report phishing" button or send it to your IT or security team the way they ask. A quick report can let the team block the sender and warn others who got the same message. If you clicked or typed a password, report that too, straight away. It is much easier to fix early.
Do this
Reporting is never a waste of time. A false alarm costs a minute. A missed phishing email can cost much more.
Try this. Open one normal email from a known sender in your inbox and find "Show original" or "View source". Find the "From", "Reply-To" and "Authentication-Results" lines. Just look; don't change anything.

Watch and read more

Lab

A written analysis of a sample email's headers, with a clear verdict and next steps.

~25 min

The problem

Below (in the starter) are the headers and body of a made-up email. All names, domains and addresses are fictional. The company's real domain is acme-traders.example.

  1. Compare the "From" address with the real company domain. What is different?
  2. Compare "From", "Reply-To" and "Return-Path". Where would your reply go?
  3. Read the "Authentication-Results" line. What passed, and for which domain? Does a pass make this safe?
  4. Read the body. List every pressure signal (urgency, secrecy, authority, skipping a process).
  5. Write a short verdict (3–5 sentences) and the steps you would take: who you would report to and how you would verify with the real Anita.

Optional: find "Show original" on one real email from a known sender in your own inbox and compare its headers. Do not share real headers with anyone outside your IT team.

Starter codetext
From: "Anita Rao (Finance Head)" <anita.rao@acme-tradres.example>
Reply-To: anita.rao.office@freemail.example
To: accounts@acme-traders.example
Subject: Urgent - vendor bank details updated, pay today
Date: Mon, 14 Sep 2026 10:42:11 +0530
Return-Path: <bounce@acme-tradres.example>
Received: from mail.acme-tradres.example (203.0.113.45)
        by mx.acme-traders.example; Mon, 14 Sep 2026 10:42:12 +0530
Authentication-Results: mx.acme-traders.example;
       spf=pass smtp.mailfrom=acme-tradres.example;
       dkim=pass header.d=acme-tradres.example;
       dmarc=pass header.from=acme-tradres.example

Hi Suresh,

Our vendor Sharma Packaging has moved to a new bank.
Please pay their pending invoice to the new account below
before 2 pm today, or the shipment will be held.

I am in back-to-back meetings, so please don't call.
Keep this between us until the audit is closed.

Account: 000000000000   IFSC: TEST0000000

Thanks,
Anita

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1The same request arrives from Anita's REAL email address, and all checks pass. What might be going on, and what do you do?Reveal

Her real mailbox may have been taken over (for example after she was phished), or someone may have access to it. The headers can't tell you that. The request itself is the warning: a bank-detail change with urgency and "don't call". Verify by calling her on a number you already have, follow the vendor bank-change process, and report it to IT so they can check her account.

Q2Why do attackers often use a different Reply-To address?Reveal

So that replies go to a mailbox they control, while the "From" line still looks familiar. If you reply to ask "is this real?", the attacker answers "yes". That is why verification must go through a separate, known channel, not a reply.

Please sign in to continue.

Questions people ask

If an email passes SPF, DKIM and DMARC, is it safe?

Not necessarily. It proves the email came from the domain it claims. If that domain is a lookalike (for example with two letters swapped), the checks can all pass. Also, a real account that has been taken over can send phishing that passes. Always judge the request too.

Should I click a link to check if it is fake?

No. Don't click to test. Hover or long-press to see the address, or report it. If you need to visit the service, type its address yourself or use a bookmark.

What if the phishing email is in my own language?

Treat it the same way. AI makes fluent messages in many languages easy. The language tells you nothing about whether it is real.

I clicked a link and typed my password. What now?

Tell your IT or security team immediately. Change the password from a trusted device, by going to the site directly. If you use the same password anywhere else, change it there too. Your team may also need to sign you out of all sessions.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in to take the test and save your progress