Remember when spotting a scam email was as easy as finding a few spelling mistakes, strange grammar, or a message that sounded like it had been translated three times before landing in your inbox?
Those were simpler times.
Unfortunately, scammers have gotten a little help from artificial intelligence (AI), and their emails are looking a whole lot more professional these days.
We're talking perfect spelling, convincing language, familiar names, and messages that look like they belong in your inbox.
The bad news? That makes phishing emails harder to recognize.
The good news? There are still plenty of warning signs to watch for. You just need to know where to look.
When Good Grammar Doesn't Mean Good Intentions
For years, one of the easiest ways to recognize a phishing email was to look for spelling and grammar mistakes.
And while those mistakes can still be a warning sign, a perfectly written email doesn't mean it's legitimate.
According to the UK's National Cyber Security Centre, AI allows scammers to create convincing phishing messages without the spelling and grammar errors that once made them easier to spot.
The FBI has issued similar warnings.
Scammers can now use AI to write messages that sound professional, friendly, urgent, or even like someone you know.
And they can do it in seconds.
It's Not Just What They Say. It's How Much They Know.
Here's where things get especially tricky.
Scammers aren't necessarily sending the same generic message to thousands of people anymore. They can use information that's publicly available to make their emails much more personal.
Think about how much information is available on a company's website or LinkedIn page. Employee names, job titles, vendors, recent projects, and company announcements can all help make a fake message sound believable.
Imagine someone in your accounting department receives an email that appears to come from a familiar supplier.
It mentions a real project, uses the supplier's name, and politely explains that their banking information has changed.
Nothing looks particularly suspicious. No misspellings. No strange wording. Just a routine request to update payment information.
Except the supplier never sent it.
That's the kind of phishing email businesses need to be watching for today.
But Doesn't Our Email Security Catch This Stuff?
A lot of it, yes!
At Layer 2, we use multiple layers of security to help protect our managed clients, including email filtering and phishing awareness training.
And those protections are important.
But no email security system can promise to catch every suspicious message.
Some phishing emails contain malicious links or attachments that security tools can recognize. Others are simply well-written messages asking someone to send money, share information, or make a change to an account.
Those can be much harder to identify automatically.
That's why we always remind clients that technology and a little human awareness work best together.
Your email security is doing its job behind the scenes, but your team is still an important part of keeping your business safe.
The Warning Signs That Still Matter
So, if spelling and grammar aren't reliable clues anymore, what should you look for?
The biggest clue is often what the message is asking you to do.
Pay extra attention when an email:
- Asks for money or gift cards. Especially when the request is unexpected or unusual.
- Requests a change to payment information. A supplier suddenly has a new bank account? Verify that before sending anything.
- Asks for passwords or verification codes. Legitimate IT support should never need you to email your password or share a one-time sign-in code.
- Creates a sense of urgency. Scammers love phrases like "immediate action required" or "your account will be suspended."
- Includes unexpected links or attachments. Even if the message appears to come from someone you recognize.
- Uses a familiar name with an unfamiliar email address. The display name might say your boss, but the actual address tells a different story.
And here's something important: Not every suspicious email will have all these warning signs.
Sometimes one unusual request is all it takes to warrant a second look.
And Now They're Calling, Too?
Unfortunately, yes.
AI isn't limited to written messages.
Scammers can also use AI-generated voices to impersonate people over the phone or in voicemail messages.
Imagine receiving a call that sounds like your boss asking you to urgently approve a payment.
Or a voicemail that sounds like someone you know requesting sensitive information.
It might sound convincing, but that doesn't mean it's real.
The FBI has warned about criminals using AI-generated audio in financial fraud and impersonation schemes.
The safest approach is the same one we recommend for suspicious emails: verify the request using contact information you already know and trust.
Don't rely on the phone number or contact information provided in the suspicious message.
A Few Simple Habits Can Make a Big Difference
You don't have to turn every employee into a cybersecurity expert to make your business safer.
A few good habits go a long way.
1. Verify changes involving money.
If a vendor emails to change their banking information, pick up the phone and call the number you already have on file. Make this a standard practice, even when the email looks legitimate.
2. Think before you click.
Unexpected link? Strange attachment? Request that seems a little out of character? Take a moment to check before opening anything.
3. Use multifactor authentication (MFA).
MFA adds another layer of protection to your accounts. Phishing-resistant MFA and passkeys offer even stronger protection against certain types of attacks.
4. Keep your team informed.
A quick reminder during a staff meeting can be surprisingly effective. Make sure everyone knows that phishing emails don't always look suspicious anymore.
5. Encourage questions.
This one is especially important to us.
Nobody should feel embarrassed about asking whether an email is legitimate.
We would much rather have someone forward a suspicious message to us for review than have them click something because they were afraid to ask.
And if it turns out to be perfectly harmless? Great! That's the outcome we like.
So, Can You Still Spot a Phishing Email?
Absolutely. You just can't rely on the same old tricks.
Bad spelling might still be a clue, but good spelling isn't proof that an email is safe.
And while spam filters and security tools catch plenty of threats, even a well-protected inbox can receive a convincing scam.
The best defense is a combination of good security tools, informed employees, and a willingness to stop and double-check when something doesn't feel right.
When an email asks you to send money, share a login, or change how someone gets paid, take a moment to verify before acting.
Layer 2 Is Here to Help
At Layer 2 Computers, we help small businesses protect their systems, their information, and their people.
From email security and phishing awareness training to helping your team recognize suspicious activity, we're here to make cybersecurity a little less intimidating.
And if you're one of our managed clients and something questionable lands in your inbox, send it our way. That's what we're here for.
Because technology should make running your business easier, not give you one more thing to worry about.
