How Cybercriminals Use AI to Create Convincing Phishing Scams

Key takeaways

• AI removes poor grammar as a warning sign and makes personalisation cheap.
• Check the request and the channel, not the writing quality: urgency, money, credentials and secrecy are still the tells.
• Verify payment or credential requests through a second, known channel before acting.
• Technical controls (DMARC, MFA with security keys or passkeys, link filtering) work even when a person is fooled.

What AI changes for attackers

Phishing has always been a numbers game with a content problem: messages had to be written, personalised and translated by hand. Generative AI lowers that cost.

• Fluent text. Emails no longer need to be badly written. Spelling errors are a weaker clue than they used to be.
• Personalisation. Public details from a profile or company website can be turned into a believable, targeted message in seconds. Targeted attacks like this are called spear phishing; see how hackers use AI for spear phishing.
• Languages and tone. A message can be produced in Hindi, Marathi or English in the style of a bank or a manager.
• Voice cloning. Short audio samples may be enough to imitate a person's voice in a phone call, known as vishing.
• Fake sites at speed. Cloned login pages and customer-support pages are easy to build and discard.

What AI does not change: the attacker still needs you to act. The goal is almost always credentials, money or a malware download, and the request still has patterns.

What are the red flags that still work?

Look at the request, not at how good the writing is.

• Urgency or secrecy ("do not tell anyone", "pay today").
• A change to bank details or a request for gift cards or crypto.
• A login link where the domain is slightly wrong. Hover or long-press to check it, or type the site address yourself.
• A request to move the conversation to another app.
• A sender who contacts you out of the blue about something you did not start.
• A caller who will not let you hang up and call back on a known number.

What are the technical defences that do not rely on you?

Email authentication

SPF, DKIM and DMARC let receiving servers check that mail claiming to be from your domain really is. DMARC, defined in RFC 7489, tells receivers what to do with mail that fails. Moving a domain to an enforcing policy reduces spoofing of your own name, though it does not stop look-alike domains.

Phishing-resistant MFA

Codes sent by SMS or typed from an app can be captured by a fake site and replayed. Security keys and passkeys (FIDO2/WebAuthn) are tied to the real website address, so a look-alike domain does not receive a usable response. Where you can, prefer them for email, banking and admin accounts.

Filtering and endpoint controls

Link and attachment scanning, safe-browsing protection in the browser and endpoint protection catch many attacks before a user sees them. Restrict who can approve payments and who can create mail forwarding rules.

Process defences for organisations

1. Call-back rule. Any change to bank details or an urgent payment request is verified by phoning a number from your records, not the number in the message.
2. Two-person approval for payments above a set limit.
3. A code word or confirmation question for sensitive phone requests, agreed in advance with family or finance staff.
4. Easy reporting. A "report phishing" button and a no-blame culture get problems raised in minutes.
5. Simulated phishing exercises that teach, not punish.

What should you do if you were fooled?

1. Stop and disconnect the device if you opened a file or entered credentials.
2. Change the password from a clean device and revoke active sessions. Turn on MFA.
3. Tell your IT or security team immediately. Speed limits the damage.
4. If money was sent, contact your bank at once and call the national cyber crime helpline 1930, then file a complaint at cybercrime.gov.in.
5. For organisations, report incidents to CERT-In as required.

Deepfakes in perspective

Voice and video imitation exist and have been used in fraud, but most attacks are still plain emails and messages. Build habits for the common case first: verify requests through a second channel, whatever the medium.

Next steps

Read how criminals use AI for social engineering and fraud for the wider picture. To learn to detect and respond to these attacks as a career, see the SOC analyst course or the Cyber Security course.

Related reading

• How AI is Enabling a New Era of Cybercrime | A Threat to Digital Security