How to Spot Phishing Emails Now That AI Writes Them Perfectly

For twenty years, security awareness training taught one heuristic above all: look for bad grammar and spelling. That advice is now dangerously obsolete. Large language models write flawless, fluent, personalized email in any language, and criminals adopted them immediately. The clumsy "Dear Costumer, your acount has been suspend" era is over.

The good news: the tells that still work were always the better tells. They're structural, not cosmetic — and no AI can fake them, because they're properties of how email and the web actually function.

01 — Stop Grading the Writing. Start Grading the Request.

Every phishing message, however beautifully written, has to eventually ask you to do something: click a link, open an attachment, enter credentials, approve a sign-in, buy gift cards, change payment details. The writing is the wrapper; the request is the attack. So evaluate the request itself:

Urgency + consequence — "your account will be closed in 24 hours," "invoice overdue, service suspended today." Manufactured time pressure exists to stop you from thinking. Legitimate organizations almost never operate this way.
Unexpectedness — a package you didn't order, a document you weren't expecting, an MFA prompt when you aren't logging in. Unexpected is the single strongest signal there is.
Channel mismatch — your bank asking for credentials by email, your CEO asking for gift cards over text, HR sending a pay-revision link from a Gmail address.

💡 Plain English: don't ask "does this email look real?" — AI guarantees it will. Ask "is this request normal, expected, and arriving through the channel this sender actually uses?"

02 — Check the Sender, Properly

The display name on an email is freely chosen by the sender — "Microsoft Account Team" can be set by anyone on earth. What matters is the actual address, and specifically the domain after the @, read right to left:

security@microsoft.com — domain is microsoft.com. ✅
security@microsoft.account-verify.com — domain is account-verify.com. Microsoft is just a decoration. ❌
security@rnicrosoft.com — that's r+n masquerading as m. Lookalike domains remain extremely common. ❌

On mobile, the display name is often all you see — tap it to expand the real address. And remember the limits of this check: a compromised real account passes it. A perfectly legitimate address sending an abnormal request (section 01) is how business email compromise works — which is why the next rule exists.

03 — Inspect Links Before You Touch Them, or Don't Touch Them at All

Hover, don't click (long-press on mobile) and read the destination domain right to left, exactly as above. paypal.com.secure-login.ru belongs to secure-login.ru.
Distrust URL shorteners and redirectors in anything security- or money-related.
The most robust habit of all: navigate independently. If "your bank" says there's a problem, close the email and type your bank's address yourself or use its app. If the problem is real, it will be visible when you log in. This single habit defeats essentially all credential phishing, regardless of how good the lure is.

04 — The New Variants AI Has Supercharged

QR-code phishing ("quishing"). A QR code in an email or on a parking meter takes the URL out of view entirely and moves the attack to your phone, which is often outside corporate protection. Treat a QR code exactly like a link: where does it go? Was it expected? Posters and stickers in public places are trivially replaced by criminals.
MFA fatigue / push bombing. Attackers with your password trigger endless approval prompts hoping you'll tap Approve to make them stop. Any MFA prompt you didn't initiate means your password is compromised — deny it and change the password immediately.
Voice cloning. A few seconds of audio is enough to fake a colleague's or family member's voice. Phone calls demanding urgent payments or credentials need the same verification as emails: hang up and call back on a number you already have. Some families now agree on a code word for emergencies — genuinely sensible, not paranoid.
Smishing. Text messages about packages, tolls, and bank alerts, written cleanly and localized perfectly. Same rules: don't tap, navigate to the service yourself.
Hyper-personalization. AI lets attackers mass-produce emails referencing your real employer, colleagues, and recent events scraped from LinkedIn and social media. Familiarity is no longer evidence of legitimacy.

05 — Make Yourself Hard to Phish Even on a Bad Day

Everyone clicks eventually — tired, rushed, distracted. The goal is to make the click survivable:

Use passkeys or a password manager. A passkey cannot be entered on a fake site at all, and a password manager refuses to autofill credentials on a domain it doesn't recognize — both turn the most dangerous moment into a dead end. (I've written a full guide to passkeys — see the link.)
Turn on number-matching MFA (typing a code shown on screen) instead of simple Approve/Deny push, if your authenticator offers it — it defeats push bombing.
Keep your browser's protection on — Enhanced Safe Browsing in Chrome, SmartScreen in Edge. They block a large share of known phishing pages before the page even renders.
Report, don't just delete — the Report Phishing button in Outlook/Gmail trains the filters protecting everyone else in your organization.

06 — The 10-Second Checklist

Question	Red flag answer
Was I expecting this?	No
Is there artificial urgency or a threat?	Yes
What's the real domain after the @?	Not the organization's own
Where does the link/QR actually point?	Anywhere unexpected
Is it asking for credentials, payment, codes, or an approval?	Yes → verify out-of-band

🔒 Bottom line: AI took away the easy tell, not your defenses. Judge the request, not the prose; read domains right to left; never travel to a sensitive site through a link someone sent you; and verify money or credential requests through a second channel you already trust. Those four habits don't care how good the writing is.