Phishing Emails Have Gotten Good. Here’s What to Look for Now

The old advice was to watch for bad grammar and clumsy spelling. That advice is now actively dangerous, because the bad grammar is gone.

For years, the tell on a phishing email was that it read like it was written by someone who did not speak the language. Misspellings, broken sentences, a greeting that got your name wrong. AI writing tools erased all of that. The phishing email in your inbox today is fluent, correctly formatted, and often written in a tone that matches the company it is pretending to be. The single most common thing people were taught to look for no longer applies.

You can no longer spot a phishing email by how it is written. You have to look at what it is asking you to do.

Stop Trusting the Writing

A well-written email is no longer evidence of anything. Attackers feed a few details into an AI tool and get back a clean, professional message in seconds. Some of them are now good enough to reference real projects or recent events, because that information was scraped from somewhere public. Polish is not proof. It never really was, but now it is not even a weak signal.

The Things That Still Give It Away

What has not changed is the underlying goal. A phishing email wants you to do something, and that intent still leaves fingerprints:

• It creates urgency, a deadline or a threat that pressures you to act before you think
• It asks you to log in through a link rather than going to the site yourself
• The sender address is subtly wrong, a lookalike domain or a display name that does not match the actual address
• It requests something unusual, a payment, a password, a gift card, a change to banking details
• It is a request that would normally happen another way, now suddenly arriving by email

The emotional pressure and the ask are the point. Those are much harder to fake away than a spelling mistake, because they are the whole reason the email exists.

The Move That Beats Almost All of It

Here is the habit worth building across your whole team. When an email asks you to log in, pay something, or change account details, do not use anything in the email. Go to the site directly in your browser, or pick up the phone and call the person on a number you already have. It takes an extra thirty seconds and it defeats the overwhelming majority of phishing, because the attack depends on you following their link instead of your own path.

The Uncomfortable Part

The honest caveat: your people will still occasionally get fooled, and training does not make anyone immune. The attacks are good and they are getting better. That is exactly why the answer cannot only be “train everyone to spot them.” It has to be paired with the technical layers that catch what people miss, email filtering, multi-factor authentication so a stolen password is not enough, and a culture where clicking the wrong thing gets reported fast instead of hidden.

Final Thoughts

The phishing advice from five years ago is not just outdated. Following it now gives people false confidence, because they are watching for a tell that no longer shows up. The new rule is simpler and holds up better: judge the request, not the writing. If an email is pressuring you to act and steering you toward a link, the quality of the prose tells you nothing worth knowing.

If your security awareness training still tells people to look for typos, it is training them to trust exactly the wrong thing.