AI-written phishing: stop looking for typos, set up passkeys

Short answer

Bad grammar no longer marks a scam. Set things up so a fake message cannot get your login even if you fall for it. Put a passkey on your email account first, then your bank and main accounts. Let a password manager (an app that stores your passwords and fills them in) fill in your logins, because it only fills them on the real site. Never act on a link or number inside a message; go to the app or type the address yourself.

Why spotting is not enough

In a 2024 study, 101 university students and affiliates were split into four groups of about 25 and sent emails. A generic phishing email (a scam email that tries to get you to click or sign in) got a 12% click rate. Emails written by human experts got 54%. Emails written and personalised entirely by an AI tool, which first searched the web for each person, also got 54% (Heiding, Lermen, Kao, Schneier and Vishwanath, 2024, preprint). The sample is small, but AI matched the experts.

Official advice says the same. The FBI warns that criminals use AI "to limit grammatical or spelling errors" that "might otherwise serve as warning signs of fraud" (FBI PSA I-120324, December 2024). The UK NCSC expected AI to make it difficult for everyone "to assess whether an email or password reset request is genuine" (NCSC, January 2024).

So the plan below does not depend on noticing anything.

The fix

1. Passkeys, email first. A passkey lets you sign in with the same face, fingerprint or PIN that opens your device, instead of a password (NCSC). It is built on the FIDO Alliance's standards (FIDO). Your browser and phone only let a passkey work on the website or app that created it, so a lookalike site cannot use it (Google for Developers). The NCSC recommends "making passkeys your first choice of login and using them wherever they are offered."

Email comes first because anyone who gets into it could "reset all your other account passwords" (NCSC).

2. A password manager for everything else. Where a site has no passkey, use a strong, separate password and turn on 2-step verification (a second check, such as a code sent to your phone). A password manager "helps protect you from phishing attacks as the password will only autofill on the correct website" (NCSC). If it does not offer your login, treat that as a warning.

Try it on five sign-in links (illustrative). Judge each one by eye, then see what a passkey would do.

3. Go there yourself. Never act from a link, button or phone number in a message. Open the app, use a bookmark or type the address. The FTC advises contacting the company "using a phone number or website you know is real" (FTC).

4. At work, call back on a known number. Any request to move money, change bank details or share a login gets a call back on a number you already have. The full rule is in Hang up and call back.

Set it up in 20 minutes

Google's passkeys need Android 9 or iOS 16 or later on phones, or Windows 10, macOS Ventura or ChromeOS 109 on computers, with a screen lock turned on. Work and school accounts may have their own rules set by an admin. On Apple devices, passkeys sync across your devices through iCloud Keychain, which needs two-factor authentication on your Apple Account (Apple).

1. I never sign in, pay or call from a link or number in a message.
   I open the app or type the address myself.
2. If my password manager does not offer my login, I stop.
3. Passkey or 2-step verification on: email, bank, <MAIN_ACCOUNTS>.
4. Money, bank details or login requests at work: I call back
   <CONTACT_NAME> on the number I already have.
5. A good-looking message proves nothing. Urgency is a reason to slow down.
6. If I clicked: change the password from <CLEAN_DEVICE>,
   then tell <WHO_TO_TELL>.

Replace the following:

• <MAIN_ACCOUNTS>: the accounts that matter most to you, such as Apple Account, PayPal, work email.
• <CONTACT_NAME>: who confirms payments, such as my manager (illustrative).
• <CLEAN_DEVICE>: a device you trust, such as my phone.
• <WHO_TO_TELL>: your IT team at work, or a family member at home.

If you already clicked or typed a password

1. From a device you trust, change that password and make it strong and new (FTC). If you used it anywhere else, our suggestion is to change it there too.
2. Turn on a passkey or 2-step verification on that account.
3. Sign out of all devices. Check the recovery email and phone, and delete any forwarding rules you did not create (FTC).
4. If you clicked a link or opened a file, update your security software and run a scan.
5. Report it. US: forward the email to reportphishing@apwg.org, forward texts to 7726, and report at ReportFraud.ftc.gov. UK: forward the email to report@phishing.gov.uk and texts to 7726; if you lost money, report to Report Fraud at reportfraud.police.uk or 0300 123 2040 (England and Wales; in Scotland, contact Police Scotland) (GOV.UK). At work, tell IT first.

If you ask an AI assistant such as ChatGPT about a suspect message, remove your personal details first (What not to paste).

How to tell it worked

Re-check your sign-in settings when you do the quarterly privacy settings pass.

Limits

Sources

1. Heiding, Lermen, Kao, Schneier and Vishwanath. "Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects", 2024. Preprint. Link
2. FBI. Public service announcement I-120324, 3 December 2024. Government advice. Link
3. NCSC. "The near-term impact of AI on the cyber threat", 24 January 2024. Government assessment. Link
4. NCSC. "Managing your passwords", reviewed 21 May 2026, and "Use a strong and separate password for your email". Government advice. Link · Link
5. FIDO Alliance. "Passkeys". Standards body. Link
6. Google. "Passkeys" (Google for Developers) and the Google Account Help page on passkeys. Vendor page. Link · Link
7. Microsoft Support. "Create and save a passkey", updated July 2026. Vendor page. Link
8. Apple Support. Page on the security of passkeys. Vendor page. Link
9. FTC. Consumer advice on phishing, on what to do if you were scammed, and on recovering a hacked email account. Regulator guidance. Link · Link · Link
10. GOV.UK. Page on reporting suspicious emails, websites and texts, updated September 2026. Government advice. Link

Changes

1. v1.010 Oct 2026first version