Detect AI Phishing Emails and Deepfakes

AI-generated phishing emails and deepfakes can look or sound convincing, so polished writing, familiar faces, and recognizable voices are not proof of authenticity. Use the checks below to pause, verify the request through a separate trusted channel, and report suspicious material without engaging with it.

What You’ll Need

• The message, email, recording, or video, preferably viewed in its original app or file rather than only as a screenshot or forwarded clip.
• A trusted way to contact the person or organization independently, such as a saved phone number, known website, or previously used company directory.
• Access to your email or platform’s reporting controls. If this concerns work, know how to contact your IT or security team.
• For a high-risk request, a second authorized person who can confirm it. Do not use contact details supplied in the suspicious message.

Step-by-Step

1. Pause before acting. Do not click links, open unexpected attachments, reply, send money, share a password or verification code, or change payment details while you assess the message. Urgency, secrecy, fear, and pressure to bypass normal procedures are warning signs, whether the content was made by AI or a person. If there may be an immediate threat, follow your organization’s incident process or contact the relevant authorities through a verified channel.
2. Identify exactly what is being requested. Summarize the action in plain language: transfer funds, reset an account, open a file, disclose information, or approve a decision. Ask whether that action is expected, appropriate, and consistent with the usual process. A genuine-looking email or familiar voice does not make an unusual request safe.
3. Check the sender and route. In email, inspect the full sender address and the actual destination of links without opening them. Look for misspellings, extra words, lookalike characters, or a domain that differs from the organization’s known domain. A display name can be forged, and a sender address alone can be spoofed. Be cautious of unexpected reply-to addresses, unusual delivery paths, and messages that ask you to move the conversation to another service. Do not treat a message as genuine merely because it appears in an existing thread; accounts can be compromised.
4. Verify the request out of band. Contact the supposed sender using a number or address you already trust, not one in the message, caller ID, or video. For a sensitive workplace action, use the established approval process and confirm with a second person. Ask about the specific request without coaching the person toward a yes. If you cannot reach them, wait rather than guessing.
5. Inspect links and attachments safely. Hover over a link on a computer, or use the app’s link-preview feature where available, to see its destination; do not click to investigate. Be wary of unexpected files, requests to enable macros or other active content, login pages reached from messages, and prompts to install software. If a file needs review, ask your security team to handle it. Do not upload private messages, recordings, or company material to public detection websites.
6. Assess calls, audio, and video for context. Look for unusual requests, abrupt changes in behavior, odd timing, or a refusal to use normal verification. Visual clues such as mismatched lip movement, unnatural blinking, strange edges, inconsistent lighting, or distorted hands can be useful, but may also result from compression or poor recording. Audio glitches and unusual cadence are likewise inconclusive. A deepfake can be clean, and a genuine recording can look imperfect; appearance is a reason to verify, not a verdict.
7. Seek independent context, not a magic detector. Check the claim with an official source reached independently, or ask the purported speaker to confirm through an established channel. Reverse-image search or reputable media-verification resources may help trace a publicly available image or video, but they can miss altered or newly created material. Automated AI detectors can produce false positives and false negatives. Treat their output as one clue, never as proof.
8. Report, preserve, and respond appropriately. Use the email service’s phishing report control or the platform’s impersonation/report option. At work, forward or report it according to internal instructions; avoid forwarding suspicious files broadly. Preserve the original message, headers, link, time, and relevant context if your security team needs them. If you already clicked, entered credentials, approved a request, or sent money, contact IT, the service provider, or your financial institution immediately through a known channel. Change exposed passwords from a trusted device, revoke active sessions if the service offers that option, and follow incident-response guidance.

Common Mistakes

• Trusting polished language. AI can write fluent messages, but humans can too. Grammar and tone cannot establish who sent a message.
• Trusting a familiar voice, face, caller ID, or email thread. These can be copied, spoofed, or compromised. Verify the action independently.
• Relying on one visual flaw or detector score. Compression can create artifacts, while convincing fakes may have none. No single clue reliably settles authenticity.
• Calling a number or following a link in the message. That may put you in contact with the attacker. Use contact information already on file or obtained from a trusted source.
• Sharing the suspicious material publicly. This can expose private information and spread a false claim. Report it to the appropriate service or security team instead.

Tips

• Agree on a verification routine for urgent money or account requests: a known callback number, a separate approval, or a prearranged phrase. A phrase is useful only if it is kept private and does not replace normal controls.
• Use multifactor authentication, unique passwords, and passkeys where available. Never disclose a one-time sign-in code to someone who contacts you.
• For organizations, make payment changes and sensitive approvals require documented checks through a separate channel, regardless of who appears in a call.
• Keep software and security tools updated, and learn the reporting route before an incident occurs. Fast reporting can help protect other recipients.

Troubleshooting

You cannot tell whether it is real: Do not act on the request. Contact the person or organization independently, and ask your security team or a trusted administrator to review it. Uncertainty is a reason to verify, not to click.

The supposed sender cannot be reached: Wait and try another previously verified contact method. Do not accept an alternate number or link supplied by the suspicious message as confirmation.

You already clicked or opened something: Stop interacting with it. If you entered a password or code, use a trusted device to secure the account and contact the service’s support or your IT team. If you downloaded a file, follow your organization’s instructions; do not try to investigate or delete evidence on a work device without guidance.

You already paid or shared sensitive information: Contact the bank, payment provider, affected service, or organizational security team immediately using independently verified contact details. Explain what happened, when, and what information or action was involved. Preserve relevant records.

A detector says the media is authentic or fake: Do not treat that result as conclusive. Check provenance and context, confirm with the purported source through a separate channel, and escalate if the consequences of being wrong are significant.

Frequently Asked Questions

Can AI-generated phishing emails be identified by bad grammar?
Not reliably. AI can produce polished text, and legitimate messages can contain errors. Judge the request, sender route, links, and independent confirmation instead.

Can I identify a deepfake by looking for visual glitches?
Sometimes glitches provide a clue, but they are not dependable proof. Video compression can cause artifacts, and high-quality fakes may show few obvious defects.

Are AI-detection tools reliable?
No detector can establish authenticity in every case. Results may be wrong, especially when material is short, compressed, edited, or outside the tool’s training data.

What is the safest way to verify a voice or video request?
Contact the person through a known number or established channel and confirm the exact request. For sensitive actions, use a second approver and the usual documented process.

Should I forward a suspected phishing email to colleagues?
Usually not. Use your provider’s phishing-report feature or your organization’s approved security reporting route so the message can be examined without unnecessary exposure.

What if I am not sure whether I exposed my account?
Tell the service provider or IT team what you clicked or entered and when. From a trusted device, secure the affected account and follow their instructions promptly.

Related

• Fix Touchpad Right Click Not Working
• Coinbase Pro vs Coinbase: Key Differences
• Games That Make You Feel Stupid: Why It Works