AI Phishing Emails: Spotting the New Tricks
Quality reviewed September 2026
Facts verified September 20, 2026
- Subject
- Career & Life Skills
- Grades
- Grades 9-12
- Length
- 9-page student worksheet
- Time
- About one 50-minute class period
- Great for
- Sub plans and independent work
- Includes
- Reading passage, comprehension questions + full answer key
- Format
- Print-and-go PDF
What students do
- Match phishing terms, from spear phishing to domain spoofing, to how the reading defines each one
- Bad grammar used to be the easiest way to spot a phishing email, and AI writing erased that warning sign
- Answer why checking an email's process now matters more than checking it for spelling errors
- Priya's suspicious university email used the real logo and colors, but a hovered link gave it away
What it covers
- Why AI writing removed the grammar and spelling mistakes that used to flag phishing emails
- The four part structure of a phishing email and new tactics like context aware timing
- Priya's case study on spotting a fake login page built to match her university exactly
Start reading this worksheet
When Bad Spelling Was Your Best Defense
For years, cybersecurity trainers taught a reassuring lesson: if an email has spelling mistakes, strange grammar, or sounds like it was translated from another language, delete it. That advice wasn't wrong; it reflected a real pattern. Most phishing emails were written by non-native English speakers working quickly, and the linguistic errors were a reliable warning sign. Security researchers called it a 'natural filter': criminals who couldn't write convincing English self-selected out of being effective against educated English-speaking targets. That filter is now gone. AI writing tools produce fluent, professionally polished text in any language, at any level of formality, in seconds. The Nigerian prince emails of the 2000s have been replaced by communications that are grammatically identical to emails from your actual bank, your actual boss, or your actual university. The old first-line defense has been eliminated, and millions of people haven't updated their threat model to account for it.
What Makes AI Phishing Different
Traditional phishing relied on volume: send millions of identical emails and count on a small percentage of recipients clicking the link or providing their credentials. Because the emails were identical, spam filters could learn to recognize and block them. AI phishing operates differently in two important ways. First, each email can be customized to its specific recipient, making it harder for automated systems to flag as suspicious. Second, AI can generate an essentially unlimited number of unique variants, meaning filter-evading becomes a continuous, automated process rather than a one-time challenge. Spear phishing (targeted attacks against specific individuals) has always been more dangerous than mass phishing, but it was expensive in human time. A skilled attacker might spend hours researching a CEO before composing a convincing fraudulent email. AI tools compress that process dramatically. Data aggregation AI can compile a target profile from public sources in minutes; writing AI can draft a convincing email in seconds; the two together turn what was once a specialized, time-intensive attack into something any technically unsophisticated criminal can execute.
The Anatomy of an AI Phishing Email
Understanding what AI phishing looks like requires looking past surface-level polish to the structural elements that reveal fraudulent intent. Modern phishing emails typically have four components: a convincing sender identity, a plausible pretext, an emotional trigger, and a call to action that bypasses normal verification procedures. The sender identity might be a slightly modified email address ('support@amazon-account-verify.com' instead of 'support@amazon.com') or it might spoof a legitimate address entirely. The pretext is the story: your account has been locked, there's been suspicious activity, you owe money, you've won a prize. The emotional trigger creates urgency or fear: act now or your account will be deleted, you have 24 hours to respond, failure to act will result in legal consequences. And the call to action always bypasses normal channels: click this link, download this attachment, call this number (which connects to a fraudster, not the real company).
Like what you read? The full reading, the case study, and every question set are in the free download below, along with the answer key.
Why this matters
Almost every student will get a message this year built to look exactly like it came from a bank, a school, or an employer, and the old advice to watch for bad grammar will not help them anymore. The reading replaces that outdated rule with a process based one: legitimate organizations follow predictable, verifiable steps, and anything that creates urgency around a password or a link deserves independent verification. Priya's story shows this is not abstract. A convincing, well written, professionally formatted email nearly cost her access to her own student account, and one phone call using a number she looked up herself was what saved her.
From one teacher to another
For years, bad grammar was the easiest way to spot a phishing email, and the reading explains why that filter is gone: AI writing tools now produce fluent, professional text in any language in seconds. It breaks a modern phishing email into four parts, a convincing sender identity, a plausible pretext, an emotional trigger, and a call to action that skips normal verification, then shows how AI adds tricks on top of that structure, like timing a fake security alert right after a real data breach. The shift in defense is from checking content for errors to checking whether a request follows an institution's normal process, since real banks and schools never ask for a password by email. Priya's case study shows that shift in action. Two habits, hovering over a link before clicking and calling an institution using a number from its own website, stop her from typing her credentials into a fake page built to look exactly like her university's.
What you get
Download
Where should I send the next one?
Everything here is free and it stays that way. Leave your email and I'll send you the new lessons as they go up. You can unsubscribe from any one of them.
Related resources
AI Safety Research: The Effort to Keep AI Aligned With Humans
AI and Election Misinformation
AI-Powered Scams: The New Wave of Fraud
Being a Responsible AI Citizen: A Personal Code of Use
Open Source vs. Closed Source AI: Why It Matters
Romance Scams Using AI Personas
Every lesson on this site is free to download and use. If one of them saved you a prep period, you can chip in a few bucks toward my three kids' daycare fund. That's genuinely where tips go.