How scammers use AI to write phishing messages and what still gives them away

AI made scam messages smoother, not smarter

For years, the advice was to look for typos. A bank email with odd grammar, a prize notice with strange capitalization. That advice is now out of date. In December 2024 the FBI’s Internet Crime Complaint Center warned that criminals use generative AI to commit fraud on a larger scale and with more believable content, and that it can correct the errors that often give fraud away.

This is not a new kind of scam. The UK NCSC assesses that criminals are using AI mainly to improve existing methods, social engineering included. The same lure, now with better writing.

What the FBI says scammers use AI for

The IC3 alert lists several uses:

• Text. Writing messages faster to reach more people, translating them to remove grammar mistakes, creating fake social media profiles, and embedding chatbots on fraudulent sites that push victims toward malicious links.
• Images. Profile photos, forged IDs such as driver’s licenses, and celebrity likenesses to promote fake products.
• Audio. Cloning a relative’s voice for a fake emergency. The FTC has warned about this since 2023, noting that scammers can clone a voice from a short clip taken from online posts. See our guide to AI voice clone scams.
• Video. Fake video calls with someone posing as an executive or official.

Put simply, tasks that used to need a skilled writer, a translator and a designer can now be done by one person in an afternoon.

An example

Imagine an email that appears to come from your delivery company. It is in fluent English, uses your name, and says a parcel is held for a small customs fee. The link opens a clean copy of the real site. Five years ago you might have caught the odd wording. Today the tell is different: you were not expecting a parcel, the fee is requested by card on a link you did not ask for, and the real company never asked for payment this way. Our phishing messages guide covers the common patterns.

What still gives scams away

AI changes the wrapping, not the ask. Look for these:

• Pressure. “Act within an hour,” “your account will be closed,” “do not tell anyone.”
• A contact you did not start. An unexpected text, call or message from “support,” a bank, a tax office or a relative on a new number.
• Unusual payment. Gift cards, crypto, wire transfers, or moving money to a “safe account.”
• Requests to leave the platform. A marketplace buyer asking to continue on WhatsApp, or a “recruiter” moving you to Telegram.
• Details that do not hold up. A caller who cannot answer a question only the real person would know.

Verify out of band

The most reliable habit is to step outside the message. Do not click, do not call the number given. Open the official app, type the website address yourself, or call the number on the back of your card. The FBI recommends hanging up and contacting the organization through a number you already know, and agreeing a secret word with family for emergencies.

If you already replied

Do not blame yourself. These messages are built to work on careful people. If you shared a password, change it everywhere you reuse it and turn on two-factor authentication. If you paid, call your bank immediately and ask about recall or a fraud claim, then report it to the FTC or IC3. If the scam started with a company breach, what to do after a data breach explains the next steps, and the breach tracker lists recent incidents that scammers may exploit.

This article reflects public information as of 2026-11-05. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.