Safety and compliance
Spotting phishing in the AI era
With AI, phishing emails have become flawless and personal. Spotting spelling mistakes no longer works. What to look for now.
5 min read
You used to spot a phishing email by its spelling mistakes and odd phrasing. With AI, fraudsters write flawless, personal messages in fluent Dutch, French or English. So you need to look for other signals.
The new signals
- Pressure and urgency: "today", "or your account will be blocked".
- An unusual request: pay to a new account number, share a code, open an attachment you weren't expecting.
- An unusual channel: a supplier suddenly writing via WhatsApp, a "boss" emailing from a private address.
- The sender's address: is the domain really right, or is one letter different?
- Links: where does the link really go? Hover over it without clicking.
The golden rule
A request for money, data or codes? Verify through a different channel you choose yourself. Call the supplier on the number you already had, not the one in the email. Ask your colleague directly.
Agree this in your team
- Any change of account number is always confirmed by phone.
- Nobody shares two-factor authentication codes, not even with "the helpdesk".
- If in doubt, report it. Ten false alarms beat one successful attack.
AI as a help
You can also show a suspicious email to an AI tool and ask for warning signs. Don't paste personal data and never click links in the email. The judgement stays with you.
Test yourself
A supplier emails, without a single mistake, that their account number has changed. What do you do?
Prompt to copy
Below is an email I find suspicious, without personal data. List the warning signs of phishing or fraud and tell me how I can check safely. I won't click any links in the email.
[paste the email]
