For years, the advice was simple: look for typos, weird formatting, and a sender address that doesn't quite match. That advice is mostly useless now. The emails hitting inboxes today are grammatically perfect, contextually relevant, and in some cases built from information an attacker scraped off your own company's LinkedIn page.
Why training alone isn't enough anymore
Generative AI didn't invent phishing, but it removed the two biggest tells that used to give it away: bad writing and generic targeting. An attacker can now feed a tool your company name, your industry, and a job title, and get back a convincing, personalized email in about fifteen seconds. Telling employees to "watch for red flags" assumes the red flags are still there. Increasingly, they aren't.
The five patterns we see most often in client environments
- Fake password reset and MFA prompts. A message that looks exactly like a Microsoft security alert, pushing the user to "verify" their account on a convincing but fake login page.
- Invoice and payment redirect fraud. An email, often inserted into a real ongoing conversation thread, asking to update banking details for an upcoming payment.
- QR codes hidden in PDFs. Email filters are good at scanning links and attachments for malicious URLs. A QR code embedded in an image inside a PDF often sails right past that scanning, and the victim scans it with their personal phone, outside any corporate protection.
- Hijacked vendor email threads. An attacker who has already compromised a supplier's mailbox will reply directly into a real, existing conversation, which makes the message far more convincing than a cold email ever could be.
- Fake IT help desk calls. A phone call following up on a phishing email, claiming to be internal IT, asking the employee to "confirm" a code that is actually their live MFA prompt.
The best phishing emails today don't look suspicious. They look exactly like the fortieth normal email you got this week.
Building defenses that don't depend on employees being perfect
Asking staff to catch every one of these, every single time, with no mistakes, isn't a security strategy. It's a hope. The more durable approach layers technical controls underneath human judgment:
- Enforce DMARC, DKIM, and SPF properly, not just in "monitor" mode. This makes it dramatically harder for attackers to spoof your domain or convincingly impersonate your vendors.
- Use safe links and safe attachments scanning that follows redirects and opens attachments in a sandbox before they ever reach the inbox.
- Put a verbal verification step on any payment or banking change, no exceptions, regardless of how urgent or senior the request appears to be.
- Run simulated phishing tests that teach, not shame. A simulation someone fails should lead to a quick, blame-free explanation of what the tell was, not a public scoreboard.
- Make the "report phishing" button the easiest button in the company to find and use. A fast, frictionless report process is worth more than a dozen additional training slides.
Phishing isn't going away, and it isn't getting less convincing. The businesses holding up best against it are the ones that stopped treating it as purely a training problem and started treating it as a layered one.