The Phishing Email That Has No Typos to Catch Anymore

An email lands from your company's finance lead, referencing a real vendor, a real invoice number, and the exact tone she uses in every other message. No spelling mistakes, no awkward phrasing, no obvious red flag. It's also completely fake, and the old advice to "look for the typos" would have told you nothing at all.

Sponsored by Behind the Markets

July 4th could kill solar — and launch this stock

Dear Reader,

On July 4th, the energy market changes.

Solar loses its biggest advantage.

Wind loses its biggest advantage.

But one energy source keeps full government backing for years.

That source is geothermal.

And Dylan Jovine believes this is the moment Wall Street is completely missing.

Because geothermal doesn’t shut off when the sun sets.

It doesn’t wait for the wind to blow.

It doesn’t burn fuel.

And it can run 24 hours a day — exactly what AI data centers need.

One company has spent decades building the infrastructure, technology, and power plants behind this resource.

And once the July 4th shift hits, this “sleepy” energy stock may not stay sleepy for long.

Get the ticker before the July 4th energy shift >>

Look Behind the Curtain

Phishing used to be easy to spot because it was often written badly. Broken English, generic greetings, and obvious formatting mistakes were the tells security training spent years teaching people to notice. Generative AI removed that tell almost entirely. A scammer can now feed a model a target's public writing, a LinkedIn post, a company bio, a few sentences from an old email, and generate a message that matches that person's tone convincingly, in perfect grammar, referencing real details scraped from public sources.

This shift shows up clearly in the data security researchers have gathered. AI-generated phishing emails now get clicked at a meaningfully higher rate than the human-written scams they replaced, and the volume of AI-assisted phishing attempts has surged sharply as the tools to produce them became cheap and widely available. Security researchers describe the core problem plainly: traditional filters were built to catch patterns, misspellings, generic phrasing, mismatched formatting, and AI-generated phishing increasingly has none of those patterns to catch.

The Capability Multiplier

Since the writing itself no longer gives the scam away, the real leverage shifts from spotting bad grammar to verifying the two things AI still can't fake on demand: an unexpected out-of-band confirmation, and the actual sending infrastructure behind the message. A polished, personalized email can still only originate from the sender's real account or a look-alike domain, and it still can't answer a callback to a phone number you already had on file before the email arrived.

That reframing is the whole advantage here. Instead of training yourself to spot subtle writing tells that AI has mostly erased, you build one habit that works regardless of how convincing the email reads: any request involving money, credentials, or sensitive data gets verified through a second channel before you act, no matter how legitimate the message looks or how well it matches someone's usual voice.

For a small business, this same principle protects against the most expensive version of this scam, a convincing email impersonating a vendor or executive requesting a wire transfer or a change to payment details. A quick phone call to a known number, not one provided in the email, catches nearly every version of this attempt before money moves.

Modern detection platforms are catching up on their end too, layering behavioral analysis and language modeling on top of traditional filters to spot AI-generated attempts that lack the old obvious tells. That's a useful second line of defense, but it's still a filter working after the message has already landed. The verification habit is the layer that works no matter what gets through.

The Sovereign Action

None of this requires new software, just a shift in what you check before acting on an email.

- Treat perfect writing and specific personal detail as no longer proof of legitimacy, since both are now easy for AI to produce convincingly.

- Verify any request involving money, credentials, or sensitive data through a separate channel, a phone call to a known number, not one supplied in the email itself.

- Check the actual sending email address, not just the display name, since look-alike domains remain one of the most reliable tells even when the writing is flawless.

- Set up a simple internal verification rule at work for wire transfers or payment detail changes: no change is processed without a callback confirmation.

- Report suspected phishing attempts to your email provider and, for a business, to your IT contact, even when nothing was clicked, since the pattern helps others get warned faster.