Phishing 2.0: spotting AI-written scam messages
Spelling mistakes used to give scams away. Now AI writes flawlessly. The signals have not disappeared, they have just moved.
The book behind this articleWhile You Scrollfor teenagers (13 to 18) For years the advice was easy: if the message from the bank had spelling mistakes, it was a scam. That trick is dead. Today anyone can ask an AI for a flawless, friendly text in your language, in the exact tone of a real company. And scammers were among the first to notice.
The good news: the signals have not disappeared, they have moved. They are no longer in how the message is written, but in what it asks of you and how it reaches you.
The new signals
- Manufactured urgency: your account will be blocked in 24 hours, last chance, confirm now. Urgency is tool number one, because nobody checks anything in a hurry.
- The link does not match: press and hold the link without opening it and look at the real domain. If the message claims to be your bank but the link goes to a strange domain, the question is answered.
- They know nothing about you: dear customer, your parcel, no order number and no name. Anyone who really has an account with you also has your details.
- Too good to be true: the prize draw you never entered, the easy well-paid job, the discount just for you. Fitting your wishes exactly is part of the design.
A flawless DM from a clothing brand: we love your profile, become our ambassador, we will send you free products, you only pay shipping. The link leads to a site identical to the official one but on a different domain, and asks for your card for a small shipping fee. Signals: flattery plus gift plus card details, and a domain that does not belong to the brand.
A text message right when you are expecting a parcel: your package is on hold, pay 1.99 to release it. Perfect wording, correct logo, coincidence does the rest. Signal: delivery companies do not charge like that by text. Open the shop's app or official website yourself and check the order status there.
And the rule that solves almost every case: never through the link you were sent. If the message claims to be your bank, a shop or a social network, close it and go in yourself through the app or by typing the usual address. If it was real, it will be there. If nothing shows up, it was smoke.
FAQ
How do I see where a link leads on my phone?
Press and hold it without letting go and the full address appears. Look at the main domain, the part right before the first slash. And if you still have doubts, do not open it: go through the app or the official website.
What if the message comes from a friend's account?
Accounts get stolen, and AI imitates the buddy tone very well. If a friend asks you for money, a code or to open a weird link, check through another channel: call them or ask in person. And a code that arrives by text never gets forwarded, to anyone.