Phishing just got better grammar
ChatGPT writes a perfect email in any language in seconds. “Look for spelling mistakes” is no longer useful advice.
For years the first tip in every awareness training was “look for bad grammar and spelling”. ChatGPT just made that tip useless. Anyone can now produce a polite, perfectly written email in English, Arabic or German, in a few seconds, tuned to sound like your finance department.
So we need checks that don’t depend on how the email reads:
- Who really sent it? Look at the actual address, not the display name.
- What does it ask for? A login, a payment, a changed bank account, a gift card, a file to open. Those are the red flags, however nice the writing.
- Is it urgent or secret? Pressure is still the attacker’s best tool.
- Verify on a different channel. Call the person on a number you already know.
On the technical side, set up SPF, DKIM and DMARC so nobody can send as your own domain, and show a clear “external sender” banner on mail from outside.
The emails will keep getting better. The questions above don’t care.