AI Writes Better Phishing Emails Now. Here Is How to Stop Them

Article

A few years ago, researchers showed that an AI language model could write spear phishing emails that more people clicked than the ones humans wrote. In 2026 that is everyday reality. Free and cheap AI tools let any scammer write a clean, personal email in seconds, in perfect English, with your vendor's name and your boss's tone.

The old warning signs are fading

Bad grammar and odd greetings used to give phishing away. Now the tells are in the request itself:

• Urgency: "need this before 3 today."
• A change to payment or bank details.
• A login link to Microsoft 365, DocuSign or a shared file you did not expect.
• A reply chain that looks real but comes from a lookalike domain.
• A follow-up phone call or text that pushes you to act. AI voice cloning makes these calls more convincing too.

What actually stops it

Training helps, but nobody catches every email. Layers do the heavy lifting:

• Email filtering that scores links, attachments and sender reputation before mail lands. We use Proofpoint.
• Phishing-resistant MFA such as passkeys or app-based sign-in, so a stolen password is not enough. See Microsoft 365 and Intune management.
• Endpoint detection that spots what a bad click launches. We use Huntress.
• A call-back rule for any payment or banking change, using a phone number you already have on file.

Bank-detail scams deserve their own rule

The most expensive phishing does not use malware at all. It asks accounting to update a vendor's bank account. Make verbal confirmation mandatory, and have two people sign off. Our email security and phishing protection page covers how we set this up for offices across Central PA.

Want a second set of eyes on this? Book a 30-minute fit call with our Mechanicsburg team.