Phishing in the Age of AI
For twenty years we taught people to spot phishing by its clumsiness: broken English, generic greetings, obviously fake addresses. That advice is now dangerous, because it trains people to trust anything polished. Generative AI writes flawless corporate prose, clones a voice from thirty seconds of audio, and personalizes a scam from your public social media in bulk. The tells have changed. The defenses have too.
What the modern lure looks like
- The perfect email. Correct branding, your real name, a plausible invoice or HR request. Grammar tells you nothing anymore.
- The cloned voice. A call that sounds exactly like your boss, or your grandchild in trouble, asking for gift cards, wire transfers, or a one-time code "to verify it's you."
- Quishing. QR codes on parking meters, restaurant tables, and posters that route to credential-harvesting pages — chosen precisely because your phone hides the URL.
- MFA fatigue. A flood of push notifications at 2 a.m. hoping you tap "Approve" just to make it stop.
- The callback scam. An invoice for something you never bought, with a helpful support number. You place the call, so it feels safe. It is not.
Defenses that survive AI
Verify through a second channel
The single most durable defense. Any urgent request involving money, credentials, or sensitive data gets verified through a channel you initiate — call the person on the number you already have, walk to their office, open the company's website by typing it yourself. Never verify through the contact details the message conveniently provides.
Let urgency itself be the red flag
Every social-engineering script — human or machine — manufactures time pressure, because reflection is fatal to the scam. "Right now," "before close of business," "don't tell anyone" are the actual signatures of modern phishing. Legitimate organizations survive a fifteen-minute delay.
Use phishing-resistant authentication
Passkeys and hardware security keys cannot be phished even by a pixel-perfect fake site: the credential simply will not release to the wrong domain. This converts "did the user notice?" into "the math said no." Pair them with a password manager that refuses to autofill on lookalike domains.
Agree on a family code word
Voice cloning broke "I recognized their voice." Pick a phrase your family would never post online, and require it for any emergency money request. Low-tech, free, and remarkably effective.
If you took the bait
- Change the exposed password immediately — and everywhere it was reused.
- Revoke active sessions and review MFA enrollments on the affected account.
- If money moved, contact your bank first, then law enforcement. Speed matters more than embarrassment.
- Report the message — to your IT team, your email provider, and the FTC. You will not be the only target.
Stop when something demands speed. Think about who is really asking. Connect only through channels you chose yourself.