Blog

AI ended the "look for typos" test. Here's what to check instead

26 October 2026 · 2 min read

"Look for spelling mistakes" was the classic advice for spotting a phishing email. It no longer works. In December 2024 the FBI warned that criminals use generative AI to write messages faster, translate them flawlessly, and remove exactly the grammar errors people had learned to look for. In its 2025 report the FBI counted 22,364 complaints mentioning AI, with close to $893 million in losses.

What AI changed

According to the FBI, criminals now use AI to:

• write convincing emails, chat messages and fake websites in perfect, natural language;
• create images for fake profiles and forged documents such as driver's licences;
• clone voices of relatives or colleagues for urgent calls asking for money;
• produce video of executives or officials for live calls.

The scam itself hasn't changed. The packaging has.

The checks that still work

Good grammar proves nothing. These five checks still catch AI-written scams, because they look at what the message wants, not how it is written:

1. What is it asking me to do? Pay, change bank details, buy gift cards, sign in, share a code, open an attachment, or install something. Any of those deserves a pause.
2. Is the request unusual for this sender? Your supplier has never asked you to switch banks before. Your manager never texts about gift cards.
3. Where does it really come from? Look at the actual email address, not the display name. Check where links go before clicking (hover on a computer, long-press on a phone).
4. Is there pressure? Deadlines, secrecy, threats, or "I'm in a meeting, just do it".
5. Can I confirm it another way? A phone call to a number you already have beats any amount of staring at the message.

Personal steps the FBI recommends

• Limit how much of your voice and image is public, especially for people who approve payments.
• Agree a secret word with family to confirm emergencies.
• Hang up and call back the organization or person on a number you look up yourself.
• Never send money or sensitive information to someone you have only met online or by phone.

For teams

Because AI makes every message look professional, technical checks matter more than ever: whether the sender's domain passes SPF, DKIM and DMARC, whether the address is a lookalike, whether the reply-to goes somewhere else, whether links hide their real destination. KnoxDefender runs those checks on every incoming message and shows its reasons in plain English, so people aren't left judging by tone alone. Its training courses teach the five checks above with realistic, fictional examples.

Sources

• FBI IC3 PSA I-120324-PSA: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (3 December 2024)
• FBI press release on the 2025 Internet Crime Report (6 April 2026)

← All stories · Questions? Contact us.