How to Spot AI-Written Phishing Emails: A Checklist for Employees

For years the advice was simple: look for bad spelling and clumsy grammar. That advice is out of date. Scammers now use AI writing tools to produce emails that read like they came from your bank, your vendor or your own boss, with perfect grammar and details pulled from your company's website and social media.

This guide gives employees a practical checklist that still works when the email looks flawless. Share it with your team, print the short version at the end, and talk it through at your next staff meeting.

Why the old warning signs stopped working

In a December 2024 public service announcement, the FBI warned that criminals use generative AI to make fraud more believable, including to fix the human errors that used to give scams away. The FBI's 2025 Internet Crime Report counted more than 22,000 complaints that involved AI, with reported losses above $893 million. Business email compromise, where a fake or hijacked email tricks someone into sending money, accounted for more than $3 billion in reported losses in 2025.

The good news: AI changes how an email is written, not what the scammer needs from you. They still need you to click, sign in, open, pay or reply. That is where you can catch them.

The checklist

1. Look at the request, not the writing

Ask yourself what the email wants you to do. Be suspicious of any message that asks you to:

• Change bank details, pay a new invoice or wire money
• Buy gift cards or send cryptocurrency
• Sign in to view a document, voicemail, invoice or shared file
• Approve a sign-in prompt or share a code you just received
• Open an attachment you were not expecting
• Keep the request confidential or skip the usual process

Urgency is a tool. Phrases like "before end of day", "I'm in a meeting, just handle this" or "your account will be closed" are designed to stop you from checking.

2. Check who really sent it

• Look at the actual email address, not just the display name. "Maria Lopez" can be anyone.
• Watch for lookalike domains: an extra letter, a swapped letter, or a different ending such as .co instead of .com.
• Check whether a reply would go to a different address than the sender.
• Notice external-sender warnings. If an email from "your CEO" is tagged as external, stop.
• Be extra careful with first-time senders, even if they mention real names and projects.

3. Inspect links and attachments

• Hover over a link (or press and hold on a phone) to see where it really goes before you click.
• Never enter your password on a page you reached from an email link. Go to the site yourself instead.
• Treat QR codes in emails the same as links. They are a common way to sneak a link past filters.
• Be wary of "shared file" notifications you did not expect, and of attachments that ask you to enable macros or sign in.

4. Ask whether it fits how this person normally works

AI can copy a writing style, but it does not know your office habits. Does your manager normally ask for payments by email? Does this vendor usually send invoices from this address? Did the request come at an odd hour or right after a reply to an old thread? A message that is out of character is worth a phone call, however professional it looks.

Phone calls and video can be faked too

The same tools can clone a voice from a short recording and produce convincing video. The FBI's announcement describes criminals using cloned voices of relatives and executives and fake video calls posing as company leaders. A follow-up call or meeting invite from the scammer is not proof of anything.

The FBI's advice is to hang up and contact the person or organization using a number you look up yourself. Some businesses also agree on a private code word for urgent money requests.

The golden rule: verify a different way

If an email asks for money, credentials or sensitive data, confirm it through a channel the scammer does not control:

If the email asks you to…	Verify by…
Change a vendor's bank details	Calling the vendor on the number already in your records
Send an urgent payment for the boss	Calling or messaging your boss directly, not replying to the email
Sign in to see a document	Opening Microsoft 365 or the site yourself, not through the link
Approve a sign-in or share a code	Never approving or sharing unless you just tried to sign in yourself
Send W-2s, payroll or customer data	Checking with your manager in person or by phone

No legitimate boss or vendor will be upset that you double-checked. Make that the official policy so nobody feels awkward doing it.

If you already clicked or replied

It happens, even to careful people. Speed matters far more than embarrassment.

1. Stop. Do not enter anything else and close the page.
2. Tell your IT contact or manager right away, including what you clicked or typed.
3. If you entered a password, change it immediately from a device you trust, and change it anywhere else you used the same password.
4. If money was sent, call your bank right away and ask about recalling the transfer, then report it at ic3.gov.
5. Use the Report button in Outlook (or forward as your IT team instructs) so others are protected.

CISA's guide to recognizing and reporting phishing makes the same point: report quickly so others can be warned.

For owners and managers

Employee awareness works best with a few simple safeguards behind it:

• A written rule that payment and bank-detail changes are always confirmed by phone
• Multi-factor authentication on every email account, so a stolen password alone is not enough
• External-sender tagging and a one-click Report button in Outlook
• Short, regular refreshers instead of a once-a-year lecture
• A no-blame culture, so people report mistakes in minutes rather than hide them for days

Print this: the 30-second check

• Does it ask for money, a password, a code or a file?
• Is it urgent, secret, or skipping the normal process?
• Is the real sender address exactly right?
• Does the link go where it claims?
• Does this fit how this person normally works?
• Can I confirm it by phone or in person first?

If any answer worries you, stop and verify.

Help for your team

Good habits plus the right settings stop most phishing before it costs anything. If you would like help setting up email filtering, MFA and short staff training sessions, get in touch with Right On Tech and we will walk you through the options.