AI makes personalised, fluent phishing cheaper, so spelling mistakes are no longer a useful safety filter. Judge the request, sender path, destination and required action instead.
Verify the person, not the performance
With AI-enabled fraud, appearance is a weak form of proof. A voice can sound familiar, a video can look convincing and a message can be polished. The safer habit is to verify the person, request or account through a route the suspicious contact does not control.
Generative tools can cheaply personalise messages using public information. That point is the reason independent verification matters more than confidence in the voice, video or message in front of you.
What matters in practice
Generative tools can cheaply personalise messages using public information.
The scammer’s advantage is often urgency rather than technical sophistication. Slowing the interaction down and switching to a known contact route removes much of that advantage.
Credential theft still depends on persuading the target to reveal information or visit a malicious destination.
Visual or audio clues can help, but they are not dependable enough for high-stakes decisions. Independent confirmation is stronger than trying to become an expert at spotting every synthetic-media artefact.
Passkeys and strong multi-factor authentication can reduce the value of stolen passwords.
Money, credentials and account recovery deserve a higher verification threshold. A familiar face or voice should never be the only reason to approve a payment, disclose a code or reset access.
Why convincing does not mean genuine
Fraud evidence is easy to overread because a convincing clip or voice creates strong emotional certainty. The right question is whether identity and intent have been independently verified, not whether the media felt authentic.
- A well-written message may be legitimate and a badly written one may still be dangerous.
- Security controls vary by service and organisation.
What could change the answer?
The practical picture changes as verification channels and criminal techniques change. Keep household and business procedures current, especially for payments, password resets and urgent requests that depend on voice or video identity.
What you can do now
Make verification routine before a crisis. The goal is to have a simple process you can follow while someone is pressuring you, not to invent a perfect test after the money or credentials have already gone.
- Open important services from a saved bookmark rather than message links.
- Use phishing-resistant authentication where available.
- Confirm unusual work requests through a known internal channel.
A four-question reality check
When a claim sounds dramatic, work through these four questions before deciding how much weight to give it.
What can the system demonstrably do?
What tools, credentials and networks can it actually reach?
Can it keep operating after errors or intervention?
What real-world outcome follows if safeguards fail?
Bottom line
The most durable defence is a verification habit that still works when synthetic media becomes harder to spot. Confirm identity independently before acting on urgency.
AI makes personalised, fluent phishing cheaper, so spelling mistakes are no longer a useful safety filter. Judge the request, sender path, destination and required action instead.
Sources & further reading
These links are selected for the claims and methods discussed above. Primary or official sources are preferred where available.
Two useful questions
What is the biggest caveat?
A well-written message may be legitimate and a badly written one may still be dangerous. Security controls vary by service and organisation.
What is the most useful next step?
Open important services from a saved bookmark rather than message links. Use phishing-resistant authentication where available.