For years, security training taught people to look for spelling mistakes and awkward phrasing in suspicious emails. Generative AI has made that advice obsolete. Attackers can now produce polished, personalised messages in any language at almost no cost.
What has changed
Lures now reference real projects, colleagues and recent events scraped from public profiles. Voice cloning adds a new channel: urgent phone calls that sound like a manager or a family member.
Verification beats detection
Because the content itself can be perfect, the most effective defence is process. Confirm payment changes and credential requests through a second, known channel. Agree on verbal code phrases for high-risk requests.
Using AI on defence
Email security platforms increasingly use language models to judge intent rather than keywords, flagging messages that pressure recipients to act urgently or bypass normal procedures. Pair them with phishing-resistant authentication such as passkeys.
Key takeaways
- What has changed
- Verification beats detection
- Using AI on defence
