Short answer
AI-written phishing emails are harder to catch because they no longer contain the typos and awkward phrasing people were taught to look for. They can read like a real contractor, client or consultant wrote them. They may also mention real projects found on a firm’s website. The better defense is checking the sender address, avoiding sign-in links in unexpected emails and verifying any money or bank change by phone. Coverage for resulting losses varies by policy, so review the actual wording.
Why AI-written phishing emails look more convincing
For years the standard advice was to look for bad grammar. That tip is much less useful now. Writing tools can produce clean, natural messages in any tone, and they can adjust the wording for a specific person or company.
Four things have changed:
- Grammar. Spelling and punctuation errors are far less common.
- Tone. Messages can match the way a project team normally writes.
- Personalization. Details such as project names and consultants can come from public websites and social media.
- Timing. An email can arrive right before a real deadline or meeting.
What an AI-written phishing email can look like
Here is an invented example. It uses no real names or projects.
Subject: Updated drawings for the 4th floor revisions
Hi Jordan, please review the attached updates before Thursday’s OAC meeting. The files are on our shared site, so you will need to sign in to view them. Thanks, Sam
Nothing in it looks careless. It refers to a plausible meeting, uses a normal tone and asks for a routine action. The risk sits in the sign-in link, because it may lead to a page designed to capture a password.
New warning signs to check
Since the writing no longer gives it away, look at other details:
- The sender address. Check the actual email address, not just the display name. A familiar name can sit on top of an unfamiliar address.
- A link to sign in. Be careful with any unexpected request to log in to view files. Go to the file service directly instead of using the link.
- Any money or bank change. A new payee or changed account details should be confirmed by phone, using a number you already have.
The phishing and IT security checklist covers the controls that support these habits.
Why fewer, better emails cost firms more
Attackers used to rely on volume. They sent huge numbers of poor messages and counted on a few replies. AI tools let them write fewer messages that are better targeted, and those tend to work more often.
The FBI’s Internet Crime Complaint Center reported that business email compromise was one of its largest loss categories in its 2025 report. The figures are reported losses, meaning complaints filed with the FBI, so they do not capture every loss. Check the IC3 annual report for the current numbers before relying on them. Some industry reports also suggest dollar losses have risen faster than complaint counts, which would be consistent with more targeted attacks.
Real-world example
Consider a hypothetical 10-person architecture firm. A project manager receives an email that appears to come from a general contractor she works with. It mentions the correct project and asks her to sign in to review revised drawings.
She notices the sender address ends in a slightly different domain than the contractor normally uses. She does not click the link. She calls the contractor on a number from her contact list, and he confirms he sent nothing.
Her habit of checking the address stopped the problem. Without it, the sign-in page could have captured her email password, and an attacker could have used the account to send payment change requests to clients.
What to check in your firm
Firms may want to review:
- Whether staff know to check the sender address instead of relying on the display name.
- Whether multifactor authentication (MFA) is on for email and file-sharing accounts.
- Whether any bank detail change requires a callback to a known number.
- Whether staff know how to report a suspicious email quickly.
- Whether the firm’s website lists staff names and project details that an attacker could reuse.
Where insurance fits with AI-written phishing emails
If a phishing email leads to a compromised account or a fraudulent payment, coverage depends on the policy. Cyber policies may respond to costs such as incident response and data restoration. Payments sent to a fraudster often fall under social engineering or crime provisions, which can carry a lower sublimit and conditions.
Many cyber applications ask about MFA, backups and payment verification. Comparing cyber quotes explains what to look at beyond price, including the social engineering line.
Hardcover insight
Many firms still train staff to look for typos, and then feel safe when an email looks clean. A polished message deserves the same scrutiny as a sloppy one. A simple habit works better than a long training session, which is to verify the sender and call back on any payment request.
Related questions
Can I still spot phishing by looking for typos?
Not reliably. Writing tools can produce clean, natural emails, so a lack of errors does not mean a message is safe.
How do I check whether an email is really from a contractor or client?
Look at the full sender address, not just the display name. For anything involving money, a link to sign in or an unusual request, confirm by phone using a number you already have.
Why would an attacker use details from our website?
Project names, staff roles and consultant relationships make an email look credible. Public information can be enough to write a message that fits a real project.
What is business email compromise?
It is a type of fraud where an attacker uses a real or imitated email account to trick someone into sending money or sharing information. The FBI tracks it as a major loss category.
Does cyber insurance cover phishing losses?
It depends on the policy and what happened. Some costs may fall under cyber coverage, while a fraudulent payment may fall under social engineering or crime provisions. Review the wording or ask a broker about a specific scenario.