Secure Your Accounts Against AI-Generated Phishing

AI-generated phishing can make fake emails, texts, calls, and login pages sound convincing and personal. These steps help you reduce the chance of handing over credentials, spot suspicious requests, and recover quickly if you respond to one. You’ll need access to your important accounts, a trusted device, and a few minutes to review their security settings.

What You’ll Need

• A phone or computer you believe is free of malware, plus access to your email and mobile number.
• A password manager, if available, to create and store unique passwords.
• An authenticator app, passkey-capable device, or security key for stronger sign-in protection.
• Account recovery codes stored somewhere secure and separate from the account they protect.

Step-by-Step

1. Secure your primary email account first. Email often controls password resets for other services. Open its settings directly—not through a message link—and change any reused or weak password to a long, unique one. Use a password manager to create it. Check recovery email addresses and phone numbers, and remove anything you do not recognize.
2. Turn on multifactor authentication. In each important account’s security or sign-in settings, enable a passkey, security key, or authenticator app if offered. These are generally more resistant to phishing than codes delivered by text. If text messages are the only option, enable them rather than leaving the account unprotected. Save backup codes offline in a secure place; do not store them in the same account they unlock.
3. Use unique passwords for every account. A convincing fake sign-in page may capture whatever you type. If you reuse a password, one compromised account can put others at risk. Change reused passwords on email, financial, work, shopping, cloud-storage, and social accounts first. Never share passwords or one-time sign-in codes with a person who contacts you.
4. Reach services through a trusted route. Don’t sign in from links in unexpected emails, texts, chat messages, or calendar invitations. Open the official app, type a known address yourself, or use a saved bookmark. Check the full domain before entering credentials; a lock icon only indicates an encrypted connection, not that a site is genuine. When uncertain, contact the organization using a number or address from a trusted source.
5. Pause on urgent or unusual requests. Treat demands to act immediately, secrecy requests, unexpected invoices, password resets, or requests for gift cards, transfers, or verification codes as warning signs. AI can imitate familiar writing or voices, so a name, tone, profile photo, or caller ID is not proof. Verify through a separate channel you already trust—for example, call a known number rather than replying.
6. Check account activity and connected access. Review recent sign-ins, devices, active sessions, forwarding rules, recovery methods, and connected apps in account settings. Sign out sessions or remove devices you cannot identify, revoke apps you no longer use, and delete unfamiliar mail forwarding rules. If a service offers sign-in alerts, turn them on and review alerts promptly.
7. Harden your devices and browser. Install operating-system, browser, and app updates from their built-in update settings. Use a device screen lock and keep security software enabled where available. Remove browser extensions you do not recognize or need. Avoid entering passwords on shared devices; if you must use one, sign out and do not save credentials.
8. Make a reporting and recovery plan. Know where to report suspicious messages in your email or messaging app. For work accounts, use your organization’s security reporting process. Keep recovery codes and account support links accessible without relying on a potentially compromised inbox. Tell close contacts how to verify unusual requests supposedly from you.
9. Act quickly if you clicked or shared information. From a trusted device, go directly to the real service, change the exposed password, and change it anywhere else it was reused. End unfamiliar sessions, revoke suspicious app access, and reset multifactor authentication if its settings may have been changed. Contact the affected organization through a verified channel. If you installed a file or app, disconnect the device from networks if appropriate and use trusted security support to check it before signing in again.

Common Mistakes

• Trusting polished writing. Correct spelling, personal details, or a familiar voice do not establish that a message is genuine.
• Checking only the sender’s display name. Names and caller IDs can be misleading. Inspect the actual address, but verify important requests independently rather than relying on appearance.
• Entering a code after following a message link. A one-time code can let an attacker complete a sign-in. Enter codes only in a sign-in flow you initiated, and never read them to a caller or send them in a message.
• Using SMS as the only protection when better options are available. Text-based verification is better than no second factor, but passkeys, security keys, and authenticator apps can provide stronger protection against fake sign-in pages.
• Ignoring recovery settings. An outdated recovery number or an attacker-added email address can undermine otherwise strong security. Review these settings after changing passwords or recovering an account.

Tips

• Start with email, then protect accounts that can expose money, identity details, work systems, or stored files.
• Use a password manager’s unique-password feature, but secure the manager itself with a strong master password and multifactor authentication.
• Make verification routine: for a request involving money, access, or sensitive data, contact the person through a separate, previously known channel.
• Keep personal details shared publicly to a sensible minimum. Information about your role, family, or schedule can make impersonation more believable.
• Report suspected phishing using the service’s built-in reporting option. Avoid forwarding suspicious files or links to others unless your workplace’s reporting procedure says to do so.

Troubleshooting

You can’t turn on multifactor authentication: Confirm that the account supports it and that your app or device is updated. Check the provider’s official help page by navigating to its site yourself. Keep the strongest available option enabled, and secure recovery methods.

You are locked out: Use the service’s official account-recovery page, reached through its known website or app. Do not trust people who contact you offering to recover the account or ask for payment, passwords, or codes. Once access is restored, change the password, review recovery details, and end unfamiliar sessions.

You received an unexpected sign-in alert: Don’t use its link. Open the account directly, review activity, and change the password from a trusted device if the sign-in was not yours. Revoke unknown sessions and check that recovery details and multifactor settings remain yours.

You already entered your password or a code: Treat the account as exposed. Change the password immediately from the genuine service, remove unknown sessions and connected apps, and contact the provider if you can’t regain control. If the password was reused, replace it on every other account using it. For a work account, notify your security team promptly.

You clicked a link but entered nothing: Close the page and don’t download or open anything from it. If you downloaded a file, installed an app, or granted permissions, use trusted device-security guidance and review account activity. A click alone does not prove an account was compromised, but stay alert for unusual prompts and sign-ins.

Frequently Asked Questions

Can AI-generated phishing be detected by spelling mistakes?
Not reliably. AI can produce fluent messages, so assess the request, destination, and context instead of using writing quality as your main test.

Are passkeys safer than passwords?
Passkeys are designed to resist fake-site credential theft and are tied to the legitimate service. Availability and recovery options vary, so keep account recovery details current.

Should I reply to ask whether a message is real?
No. A real-looking reply can come from a compromised account, and a fake sender can respond. Contact the person or organization through a separate trusted route.

What if a caller sounds exactly like someone I know?
End the call and contact that person using a number you already have. Agree on a verification phrase with close contacts if impersonation is a concern, and never rely on voice alone for a sensitive request.

Do I need to change every password regularly?
Not necessarily. Use unique passwords and change one promptly if it was exposed, reused, or the service reports a breach. Keep multifactor authentication and recovery settings up to date.

Where should I report a phishing message?
Use the email or messaging service’s report-phishing option. For a work message, follow your organization’s reporting process; for an account takeover, contact the service through its official support channel.

Related

• Bose SoundLink Micro 2nd Gen: What to Know
• What Frayed Lightning Cable? Identify and Replace It
• Siri AI Upgrades Delayed? What Apple Has Confirmed