Why scam messages have got better
Phishing is when a scammer pretends to be someone you trust to get your money, passwords or details. It used to be easy to spot by the broken English. The UK National Cyber Security Centre says generative AI can now produce convincing messages and lure documents without the translation, spelling and grammar mistakes that often give phishing away. Europol adds that messages can include the language and cultural details of the victim's own country, and cites research finding that AI-written phishing got a significantly higher click rate than human-written messages.
Scamwatch says AI helps scammers write thousands of personalised messages using personal information found online. The FBI says generative AI reduces the time and effort criminals need and can fix the errors that used to be warning signs. Australia's National Anti-Scam Centre notes that AI is making significant scams harder for people to recognise. The UK National Cyber Security Centre adds that criminals use information about you that is available online, including on social media, to make phishing more convincing. The lesson is calm and practical: good spelling no longer means a message is safe.
Remember
Facts and sources for this part
- The UK National Cyber Security Centre says generative AI can create convincing messages and lure documents without the translation, spelling and grammar mistakes that often give phishing away. [KS27]
- Its 2024 assessment expected that AI would make it hard for anyone, whatever their level of cyber knowledge, to tell whether an email or password-reset request is genuine. [KS27]
- Europol reports research finding that phishing messages written by large language models have a significantly higher click-through rate than messages likely written by humans. [KS28]
- Europol says phishing texts and scripts can now include the language and cultural details of the victim's location. [KS28]
- Scamwatch says AI helps scammers create thousands of personalised emails, texts and social media messages using personal information found online. [KS7]
- The FBI says generative AI reduces the time and effort criminals need to deceive people, and can correct the human errors that might otherwise be warning signs of fraud. [KS14]
- Australia's National Anti-Scam Centre says AI is making significant scams harder for people to recognise. [KS1]
- The UK National Cyber Security Centre says criminals use information about you that is available online, including on social media, to make their phishing messages more convincing. [KS25]
What has not changed: the request
The wording is better, but the request is the same. The Australian Cyber Security Centre's warning signs still apply: pressure to act quickly, requests for passwords or authentication codes, and callers asking you to skip normal security steps. Reputable organisations do not call, text or email you to verify or update your details, and the US Federal Trade Commission says the same about requests for bank account or card numbers.
So instead of asking "does this look right?", ask "what is it asking me to do?". If the answer is to pay, log in, share a code or change bank details, treat it as unverified until you check by another route. Scamwatch also suggests searching online for the exact wording of the message or the number, plus the word "scam".
Remember
Facts and sources for this part
- Phishing warning signs listed by the Australian Cyber Security Centre include pressure to act quickly, requests for passwords or authentication codes, and callers asking you to skip normal security steps. [KS11]
- Reputable organisations do not call, text or email you to verify or update your information. [KS9]
- The US consumer regulator says honest organisations will not call, email or text to ask for your personal information such as bank account or card numbers. [KS19]
- Scamwatch advises never sharing personal information, card details, passwords or one-time codes with anyone who contacts you unexpectedly, even if they claim to be from your bank. [KS2]
- Scamwatch also suggests searching online for the exact wording of the message, the phone number or the sender, plus the word "scam". [KS2]
SMS and chat tricks
Scammers use text and chat because they feel personal and fast. Scamwatch warns that a fake text can appear in the same thread as genuine texts from your bank, and that caller and sender IDs can be faked, so watch for small differences such as extra dots, special characters or numbers. The US Federal Trade Commission also notes that scammers can change the number shown on your caller ID.
The FBI describes impersonation campaigns in which criminals ask, almost straight away, to move the chat to an encrypted messaging app. The FBI also says never to give a two-factor code to anyone over email, text or messaging apps. A Peruvian state bank explains the same idea for phone spoofing: its staff will never ask for passwords, codes sent to your phone or card numbers by phone, text or email.
Remember
Facts and sources for this part
- Scamwatch tells people to watch for slight differences in caller or sender IDs, such as dots, special characters or numbers. [KS2]
- Scammers can make a fake text appear in the same message thread as genuine texts from your bank. [KS2]
- The US regulator says scammers use technology to change the number shown on your caller ID, so the name and number you see might not be real. [KS19]
- In impersonation campaigns the FBI describes, criminals ask to move the chat to an encrypted messaging app almost straight away. [KS18]
- The FBI says never to give a two-factor code to anyone over email, text or a messaging app, because criminals use social engineering to get codes and take over accounts. [KS15]
- A Peruvian state bank warns that its staff will never ask by phone, text or email for confidential information such as passwords, codes sent to the phone, card numbers or card security digits. [KS43]
- The same bank explains that "spoofing" masks a phone number so the call looks like it comes from a financial institution, to win the customer's trust. [KS43]
QR codes and links
Quishing is phishing that uses a QR code instead of a link. The Australian Cyber Security Centre says it can be harder to catch because the code is an image: security tools may miss it, and you cannot read the link before you scan. The FBI's advice for links is simple: do not click a link in an email or text until you have independently confirmed who sent it.
Our advice: if a message asks you to scan or click, go to the organisation's website by typing the address yourself, or open its app, and look for the same notice there.
Remember
Facts and sources for this part
- Quishing is phishing that uses QR codes instead of links. It is harder to catch because the code is an image, so security tools may miss it and you cannot read the link before scanning. [KS11]
- The FBI says not to click links in an email or text until you have independently confirmed who sent it. [KS15]
A note for managers: training that helps
The UK National Cyber Security Centre says no training, including phishing simulations, can teach people to spot every phishing attempt, and that blaming people for clicking does not work. It adds that staff who fear for their jobs will not report mistakes. The goal is therefore not to make everyone a detective but to make reporting quick and safe, and to put checks around the actions that matter, such as payments and password resets.
Remember
Facts and sources for this part
- The UK National Cyber Security Centre says no training, including phishing simulations, can teach people to spot every phishing attempt, and that blaming or punishing people for clicking does not work. [KS24]
- It adds that people who fear for their jobs will not report mistakes, so reporting needs to feel safe. [KS24]
- The UK National Cyber Security Centre says a positive culture, where people feel comfortable reporting phishing, turns staff into an early warning system. [KS24]
Scenario 1: a text message
Tom's phone shows a text in the same thread as his earlier messages from Larkspur Bank (invented): "Larkspur Alert: unusual payment of $2,450 to a new payee. If this was not you, call our fraud team now on 02 5550 0142 to secure your account." A minute later a "fraud officer" calls from that number and asks him to read out the code that was just texted to him.
Red flags: The text sits in a real-looking thread, which proves nothing; It gives you a number to call, which is controlled by the scammer; The caller asks for a one-time code, which no real bank staff member needs.
What to do: Do not read out the code. Hang up. Call the bank on the number printed on your card or shown in its app, and ask about the payment. If you have already shared a code, tell the bank straight away so it can stop transactions and secure the account.
Remember
- The text sits in a real-looking thread, which proves nothing
- It gives you a number to call, which is controlled by the scammer
- The caller asks for a one-time code, which no real bank staff member needs
Facts and sources for this part
- Scammers can make a fake text appear in the same message thread as genuine texts from your bank. [KS2]
- Scamwatch tells people to watch for slight differences in caller or sender IDs, such as dots, special characters or numbers. [KS2]
- Scamwatch advises never sharing personal information, card details, passwords or one-time codes with anyone who contacts you unexpectedly, even if they claim to be from your bank. [KS2]
- The FBI says never to give a two-factor code to anyone over email, text or a messaging app, because criminals use social engineering to get codes and take over accounts. [KS15]
- The same bank explains that "spoofing" masks a phone number so the call looks like it comes from a financial institution, to win the customer's trust. [KS43]
Scenario 2: an email
Staff at a small clinic receive a well-written email from "IT Service Desk" at "helpdesk@clinic-it-support.example": "Your mailbox password expires in 2 hours. Sign in below to keep your account active." The link goes to a page that looks like the usual sign-in page. The message uses each person's first name and job title.
Red flags: The email asks you to sign in through a link, with a short deadline; Personal details (name, title) make it feel genuine, but they are easy to find online; The sender domain is not the one your IT team normally uses.
What to do: Do not click. Open your mailbox the way you normally do, by typing the address or using the saved bookmark, and see if there is any warning. Report the email to IT using the report button or the agreed address, so others can be warned. If you clicked and typed your password, change it at once and tell IT.
Remember
- The email asks you to sign in through a link, with a short deadline
- Personal details (name, title) make it feel genuine, but they are easy to find online
- The sender domain is not the one your IT team normally uses
Facts and sources for this part
- The UK National Cyber Security Centre says generative AI can create convincing messages and lure documents without the translation, spelling and grammar mistakes that often give phishing away. [KS27]
- Phishing warning signs listed by the Australian Cyber Security Centre include pressure to act quickly, requests for passwords or authentication codes, and callers asking you to skip normal security steps. [KS11]
- Reputable organisations do not call, text or email you to verify or update your information. [KS9]
- The FBI says not to click links in an email or text until you have independently confirmed who sent it. [KS15]
Scenario 3: a chat message
Priya, a team member, gets a chat message from an unknown number: "Hi Priya, it's Marcus, I lost my phone and this is my new number. Can you save it? I need a quick favour: a supplier is waiting on a payment and I can't access my banking app. Can you transfer $1,900 and I'll pay you back tonight?"
Red flags: A "new number" message from someone you know; A request to move money quickly because a normal route is "unavailable"; A personal repayment promise, instead of a normal company payment process.
What to do: Do not transfer anything. Contact Marcus on the old number you have saved, or ask a colleague to confirm in person. Do not reply to the new number with any details. Report it to your manager.
Remember
- A "new number" message from someone you know
- A request to move money quickly because a normal route is "unavailable"
- A personal repayment promise, instead of a normal company payment process
Facts and sources for this part
- The FBI says that if someone you know contacts you from a new platform or number, you should verify the new contact through a previously confirmed platform or trusted source. [KS15]
- Scamwatch says to always call a friend or family member back on their real number, and not to reply to a message from a new number claiming to be them. [KS7]
- The FBI also says to critically evaluate the context and plausibility of any request for money. [KS15]
Scenario 4: a text message
A text arrives at a company mobile: "Your vehicle has an unpaid fee. Pay within 24 hours to avoid a penalty: pay-fines-portal.example/q7x". It looks like it is from a government agency. The employee drives a company vehicle.
Red flags: An unexpected fee with a short deadline and a link; A link you cannot verify on a mobile screen; The link's address does not match any known agency.
What to do: Do not tap the link. Check for the fee through the agency's own website, which you type in yourself, or phone the number on its real website. Forward the text to whoever manages company vehicles, and delete it.
Remember
- An unexpected fee with a short deadline and a link
- A link you cannot verify on a mobile screen
- The link's address does not match any known agency
Facts and sources for this part
- The FBI says not to click links in an email or text until you have independently confirmed who sent it. [KS15]
- Reputable organisations do not call, text or email you to verify or update your information. [KS9]
- Phishing warning signs listed by the Australian Cyber Security Centre include pressure to act quickly, requests for passwords or authentication codes, and callers asking you to skip normal security steps. [KS11]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
What does the UK National Cyber Security Centre say about phishing training?
Show the answer
Right answer: C, No training can teach people to spot every attempt, and blaming people does not work. The aim is easy, safe reporting and checks around key actions, not perfect detection. [KS24]
Question 2 of 3
Staff receive a polished email from "IT Service Desk" saying their password expires in 2 hours and asking them to sign in via a link. What is the best response?
Show the answer
Right answer: B, Don't click; open your mailbox by typing the address or using a bookmark, and report it. Pressure to act quickly and a sign-in link are warning signs. Go to the service yourself. [KS9]
Question 3 of 3
What does the FBI say about two-factor codes?
Show the answer
Right answer: D, Never give one to anyone over email, text or a messaging app. Criminals use social engineering to get people to read out a code, which lets them take over accounts. [KS15]