Spot and Report AI-Generated Phishing Emails

AI-generated phishing emails can sound polished, personal, and convincing, so spelling errors alone are no longer a reliable warning sign. This guide helps you check suspicious messages safely, avoid interacting with them, and report them through the right channel; you do not need special software to begin.

What You’ll Need

• Access to the email account or app where the message arrived.
• Your workplace or school’s security-reporting process, if applicable. For personal accounts, use the email provider’s built-in phishing or spam report option.
• A way to contact the supposed sender using a known, separate route, such as a saved phone number or previously verified address.

Step-by-Step

1. Pause before taking action. Do not click links, open attachments, reply, scan QR codes, or call numbers in the message. Avoid forwarding it to colleagues as an ordinary attachment; forwarding can expose them to dangerous content. If you already clicked or opened something, stop interacting with the message and go to the troubleshooting section.
2. Check what the email is asking you to do. Be cautious of requests to pay an invoice, change bank details, disclose passwords or verification codes, approve a sign-in, buy gift cards, or act urgently. A familiar name, logo, writing style, or details about your job do not prove the message is genuine. AI can produce fluent text and may use publicly available or previously stolen information.
3. Inspect the sender and the reply address. In the message details, look at the full email address, not just the display name. Check for misspellings, extra words, unusual domains, or a mismatch between the apparent sender and the address used for replies. Some apps show these details only after you select the sender’s name. A legitimate-looking address is not conclusive: accounts can be compromised, and displayed sender information can be misleading.
4. Examine links without opening them. On a computer, hover over a link to preview its destination. On a phone or tablet, press and hold only if your app safely displays a preview without opening the link; otherwise, do not test it. Look for a destination that differs from the organisation’s known domain, unexpected redirects, shortened links, or a misspelled domain. Do not enter a password to check whether a site is real. If uncertain, open the organisation’s official app or type its known address yourself.
5. Look for unusual context, not just poor writing. Compare the request with normal procedures: Is this the usual channel, timing, recipient, and approval process? Does the message create pressure, secrecy, or a sudden change in payment or account details? Generic greetings, odd formatting, or inconsistent details can be clues, but polished language and correct personal details can appear in scams too. No single clue reliably identifies AI use.
6. Verify the request independently. Contact the person or organisation using a number, address, or internal directory you already trust—not details in the suspicious email. Ask whether they sent it and whether the requested action is expected. For payment or account changes, follow your organisation’s established verification and approval process even if the sender confirms through email.
7. Report it using the appropriate channel. At work or school, use the designated “Report phishing” button or contact the IT/security team through a known route. For personal email, use the provider’s “Report phishing” option; use “Report spam” only when phishing reporting is unavailable or the message is mainly unsolicited junk. A report button may submit message details and headers to the provider or your organisation. Follow your local instructions.
8. Preserve useful details and remove the message as directed. Keep the message in your inbox until your security team says otherwise, or use the built-in reporting flow, which may move it automatically. If asked, provide the sender address, time received, subject, and what you did. Do not edit the message or strip its headers if a security team needs the original. After reporting, delete or quarantine it according to their instructions.

Common Mistakes

• Trusting polished writing. Good grammar, natural wording, or a personalised greeting does not establish that a message is legitimate.
• Assuming every odd phrase means AI. Human-written scams, translation tools, and legitimate automated messages can also sound unusual. Report suspicious behaviour; do not claim certainty about how the message was made.
• Clicking to investigate. Opening a link, attachment, or QR code can expose you to credential theft or malware. Use a known official route instead.
• Replying to ask if it is real. Replies can confirm that your address is active and may continue the scam. Verify independently.
• Reporting only to the apparent sender. If the account is compromised, the attacker may see your reply. Report through your provider or security team.
• Deleting evidence too early. Security staff may need the original message or its headers. Use the reporting process first and follow their retention instructions.

Tips

• Make a habit of checking the complete sender address and the destination of links before acting.
• Use a bookmark or the organisation’s official app for sign-ins, invoices, and account notices rather than email links.
• Be especially careful with unexpected changes to payment instructions, shared files, password resets, and requests for verification codes.
• Report suspected phishing even if you are not sure. Security teams can assess it; you do not need to prove it was generated by AI.
• If a message looks like it came from a colleague, verify unusual requests through a second channel and follow normal approval controls.

Troubleshooting

You cannot find a phishing-report button: Check the message’s “More” menu or your organisation’s security guidance. If unavailable, contact IT/security using its known help desk or report address. For personal email, look in the provider’s help pages or message menu. Do not forward the email to an address found inside the suspicious message.

You already clicked a link but did not enter information: Close the page without downloading anything or granting permissions. Report the message and tell your security team what happened. If the device behaves unusually, follow your organisation’s incident instructions rather than trying to clean it up yourself.

You entered a password or a verification code: From a trusted device, go directly to the official service and change the affected password. If you reused it elsewhere, change it on those accounts too. Tell your IT/security team promptly if it is a work or school account. Contact the service provider through its official app or website, review active sessions, and revoke ones you do not recognise where that option is available. Never share a new verification code with someone who contacts you.

You opened an attachment or approved a sign-in: Stop using the file or approving prompts, and contact your security team immediately. Give them the time, device, and actions taken. If you are on a managed device, do not disconnect, reset, or delete files unless instructed; the response team may need to preserve evidence.

You reported a legitimate message by mistake: Tell your IT/security team or email provider. Do not use links in the message to undo the report. If the message was moved, your administrator or provider may be able to restore it.

Frequently Asked Questions

Can I tell whether an email was written by AI?
Usually not with confidence. AI-generated and human-written messages can look alike, and automated detectors are not dependable proof. Judge the request, sender, links, and context instead.

Does correct grammar mean an email is safe?
No. Scammers can use AI, templates, or editing tools to produce polished messages. Treat unexpected requests cautiously regardless of writing quality.

Should I forward a suspicious email to my coworkers?
No. Use the official reporting button or security contact. Forwarding may expose others to active links or attachments and may remove information needed for investigation.

What if the email appears to come from someone I know?
Verify the request using a separate, previously trusted contact method. A familiar account can be impersonated or compromised.

Should I report an email if I am unsure?
Yes. Use your provider’s or organisation’s reporting channel and describe what concerned you. Let the security team decide whether it is malicious.

Related

• Default Gateway Is Not Available: Fixed
• Shared Photo Libraries: What Happens When You Delete a Photo?
• Best Single Player FPS Games: Top Picks