Spot AI Phishing Emails, Texts, and Deepfakes

This guide helps you assess suspicious messages and convincing audio or video before you act. You do not need special software: pause, verify the request through a separate trusted channel, and treat clues as reasons to check—not proof that something is fake.

What You’ll Need

• The message, email, or recording, viewed without clicking links or opening unexpected attachments.
• A trusted way to contact the person or organization independently, such as a saved phone number, official app, or website address you type yourself.
• If the message is at work or school, your organization’s security reporting process.

Step-by-Step

1. Stop before responding. Do not click a link, scan a QR code, open an attachment, share a login code, send money, or approve a sign-in request while you assess it. Urgent language is designed to shorten your thinking time. If a request might be genuine, you can still verify it after pausing.
2. Identify what the sender wants. Look for the action: paying an invoice, changing bank details, buying gift cards, resetting a password, disclosing information, or keeping a conversation secret. A familiar name or realistic writing style does not establish that the request is authentic; accounts and caller IDs can be impersonated.
3. Inspect the sender and destination carefully. Check the complete email address, phone number, and link destination—not just the displayed name or link text. On a computer, hover over a link without clicking; on a phone, use the link preview if available. Watch for misspellings, extra words, lookalike characters, shortened links, and domains that differ from the organization’s known address. Do not rely on a padlock icon: it indicates an encrypted connection, not an honest site.
4. Check the context and pressure. Ask whether you expected the message, whether the request fits the person’s normal role and habits, and whether it asks you to bypass usual checks. Unexpected urgency, secrecy, threats, unusual payment methods, or requests to move to another app are warning signs. So are vague greetings or oddly polished wording—but neither poor grammar nor perfect grammar proves anything.
5. Verify using a separate channel. Contact the supposed sender using a number or address you already had, not details supplied in the suspicious message. For a company, visit its official site by typing the address or opening a saved bookmark, then use its published contact method. Ask specifically whether the request and any changed payment or account details are genuine. For a workplace request, follow the established approval process.
6. Check a voice or video request with a challenge. If a voice message or live call asks for money, credentials, confidential information, or urgent action, end the interaction and call the person on a known number. Agree on a family or team code word for urgent requests if useful, but keep it private and change it if exposed. Ask an unexpected caller a question that only the real person would know, while remembering that personal details may be publicly available.
7. Assess media cautiously. Listen and watch for inconsistent lip movement, unnatural pauses, odd facial motion, abrupt changes in lighting, or audio that sounds unusually flat. These can justify extra checks, but compression, editing, accents, disability, poor connections, and ordinary recording artifacts can create similar effects. Do not use a single visual glitch—or an online “AI detector”—as a verdict.
8. Decide, report, and preserve evidence. If independently verified, proceed through the normal process. If you cannot verify it, do not comply; report it through your email or messaging app’s phishing/report option, or your organization’s security team. Keep the original message, sender details, links, and relevant time. Avoid forwarding suspicious attachments or media to others; follow your organization’s reporting instructions.

Common Mistakes

• Trusting familiar appearance. A known name, profile photo, voice, or email signature can be copied or impersonated. Verify the request, not just the identity it presents.
• Looking for one “tell.” Spelling errors, strange hands, robotic speech, or awkward phrasing are not reliable tests. Generative tools can produce fluent text and convincing media, while legitimate content can look imperfect.
• Calling a number in the message. That number may belong to the impersonator. Use contact information already saved or independently obtained from an official source.
• Assuming a detector settles the question. Detection services can make mistakes, and their results may vary by file quality or editing. Do not upload private work or personal recordings to an unfamiliar service just to get a score.
• Replying to challenge the sender. A reply can confirm that your address or number is active. Use a reporting mechanism instead.

Tips

• Use multifactor authentication and unique passwords. Never share a one-time passcode or approve a login you did not initiate.
• Set a second-person check for unusual payments, new bank details, gift-card purchases, or sensitive data requests. Confirm through a different channel.
• Keep operating system, browser, and security software updated, and enable available spam and phishing filters.
• Agree with family or colleagues on a simple procedure for urgent requests. A call-back to a saved number is more dependable than trying to judge a voice from a recording.
• When reporting, include the original message or a screenshot if your organization requests one, but do not expose private information publicly.

Troubleshooting

You cannot tell whether it is genuine: Do not act on the request yet. Contact the sender through a known channel or ask the organization’s published support team. If no independent confirmation is available, treat the request as unverified.

The message claims your account will be closed immediately: Open the official app or type the service’s known website address yourself. Check account notifications there; do not use the message link or call its number.

You already clicked or opened something: Close the page, do not enter more information, and report what happened to your organization or the relevant service. If you entered a password, change it using the genuine site or app and update any reused passwords. If you disclosed a one-time code or approved a login, contact the service promptly and review active sessions and account security. If a file was opened, follow your organization’s device-incident instructions; avoid trying to investigate by running more files.

You sent money or sensitive information: Contact your bank or payment provider promptly using its official number, and notify the affected organization or account provider. Preserve messages and transaction details. If this happened at work, alert the security or finance team immediately.

A detector says a recording is real or fake: Treat that output as one uncertain clue. Verify the speaker and request independently; do not make a high-impact decision based solely on a detector score or a media artifact.

Frequently Asked Questions

Can AI-generated phishing be identified by bad grammar?
No. Generated messages can be polished, and real messages can contain mistakes. Check the request, sender route, links, and context instead.

Can a phone call or video prove who is speaking?
No. Voice and video can be copied or manipulated. For sensitive or urgent requests, call back using a number you already trust.

Is every unexpected message a scam?
No. Unexpected messages can be legitimate, but they deserve verification before you follow links, share information, or make a payment.

Should I use an AI detector?
You may use one as a limited clue, but results are not definitive. Do not upload confidential material without understanding the service’s privacy terms.

What should I do if I receive a suspicious work message?
Use your organization’s report-phishing control or security process. Do not forward it casually, and tell the security team if you clicked, replied, or shared information.

What if the sender is a friend or relative?
Contact them through a saved number or another established channel. Ask them to confirm the exact request, especially before sending money or revealing a code.

Related

• Use Gemini Extensions? What They Do and How to Choose
• Replace Reused Passwords Safely Across Your Accounts
• Intel Xeon Scalable Processors: Generations and Uses