The tell-tale signs of phishing — clumsy grammar, generic greetings, suspicious links — are gone. AI-written scams now mimic your bank, your boss and your favourite services with unsettling precision.
Security researchers report that AI-generated phishing achieves click rates several times higher than traditional campaigns, and voice-cloning has upgraded phone scams into convincing emergencies featuring familiar voices.
The defence that still works is procedural, not perceptive: never act on urgency inside a message. Navigate to services directly rather than through links, and verify unusual requests on a second channel you initiate.
The stronger fix is structural — passkeys and hardware security keys make stolen credentials worthless. Enable them wherever offered; they turn the most sophisticated phishing attack into a dead end.