The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Generative AI can help attackers write phishing emails that sound fluent, fit a target, and arrive at greater speed and scale. That makes polished grammar—and even personal details—poor proof that a message is genuine. The safer test is whether the sender and request can be verified independently.
What generative AI changes about phishing email
Phishing is a deceptive message intended to persuade someone to take an unsafe action, such as revealing credentials, sharing sensitive information, or sending money. Generative AI changes how easily an attacker can produce and adapt the message; it does not change the need for the message to persuade its recipient.
The FBI’s Internet Crime Complaint Center (IC3) explains that generative AI creates new content from examples supplied by a user. In its December 3, 2024 advisory, the FBI says these tools reduce the time and effort criminals need to deceive people, can produce messages faster for a wider audience, and can correct errors that might otherwise be warning signs. The advisory identifies social engineering, spear phishing, and financial fraud as uses for AI-generated text. Read the FBI IC3 advisory.
In practical terms, an attacker can use a tool to draft or revise a message, make its wording more fluent, or translate it. An attacker may also try to tailor a lure to a particular person or situation. Microsoft’s 2025 Digital Defense Report says AI enables more targeted phishing and better lures. The important point is not that every AI-written message contains accurate personal knowledge; it is that adapting plausible-sounding language can take less effort.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
These capabilities can benefit both broad campaigns and messages aimed at specific people. A wider campaign needs many recipients to find a message plausible enough to act on; a targeted attempt needs a believable reason for one person to respond. AI can help with the wording in either case, but it does not prove that the message’s claims are true or that its sender is who they say they are.
Why a convincing email may still be fraudulent
Fluent writing is no longer a reliable authenticity check
Some scams used to be easier to doubt because of awkward phrasing, spelling errors, or grammar mistakes. The FBI warns that AI tools can correct errors that might otherwise serve as warning signs and can translate text while limiting language errors. A well-written email may therefore be fraudulent, while a typo by itself does not establish that a message is a scam.
The same caution applies to a message that sounds formal, friendly, or unusually polished. Style is not a dependable way to establish who sent an email. Treat language quality as, at most, one small part of your judgment—not as a pass/fail test.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Personal details and a plausible story are not verification
A targeted message may use details that make its story feel relevant. But relevance does not authenticate the sender: a familiar name, a believable work context, or a reference to something you recognize can still appear in a deceptive request. The FBI specifically identifies social engineering and spear phishing as uses for AI-generated text, while Microsoft describes more targeted phishing and better lures.
Focus instead on what the message wants you to do and whether that action has been confirmed through a separate, trusted route. Requests involving payment, credentials, or sensitive information deserve independent verification even when the email reads naturally and its story sounds plausible.
What Microsoft’s click-through figures do—and do not—show
Microsoft’s Digital Defense Report 2025 reports that “AI-automated phishing emails achieved 54% click-through rates compared to 12% for standard attempts”—a 4.5-times difference in that reported comparison. Those are Microsoft’s figures from its report, not a universal success rate for phishing emails. The comparison does not establish that AI alone caused the difference or that every campaign using AI will perform similarly. Read Microsoft’s 2025 Digital Defense Report.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Reported measure | Figure | How to interpret it |
|---|---|---|
| AI-automated phishing email click-through | 54% | Microsoft’s reported result in its 2025 report; not a rate for all AI-assisted phishing. |
| Standard phishing-attempt click-through | 12% | The comparator reported by Microsoft for the same comparison; it does not prove AI was the sole cause of the difference. |
| Difference described by Microsoft | 4.5× | Microsoft’s description of the relationship between the two reported click-through figures, not a guaranteed multiplier for another campaign. |
Click-through is an outcome reported for the attempts in that comparison, not evidence that all recipients who click disclose credentials, transfer money, or suffer account loss. Nor does the comparison say how common AI-written phishing is across email generally. It should be used to understand why convincing lures matter, not to estimate an individual’s odds of encountering one.
Recommended Free Tools
How to assess a suspicious email without trying to identify its author
There is no dependable visual test in the cited guidance for deciding that an email was written by AI. The practical question is whether the message and its request are legitimate. Instead of trying to spot a particular writing style, pause and assess the requested action, then confirm it through a channel that did not come from the email.
- Identify the requested action. Is the message asking you to pay, share credentials or sensitive information, or take another consequential step?
- Notice pressure or an unexpected change. Urgency or a new payment instruction is a reason to verify, not a reason to skip verification. This is a precaution, not proof that the email is fraudulent.
- Separate plausibility from identity. A convincing explanation and correct personal details do not independently confirm who sent the message.
- Choose a contact route independently. Do not rely on contact details or a reply path supplied only in the message you are checking.
The FBI’s advice is to research the purported organization’s contact information and call it directly. For a workplace request, use an established internal contact route or the organization’s reporting process rather than treating the email itself as confirmation. If you cannot verify the sender or request, do not complete the requested transaction or disclose information while you are uncertain.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do before responding to a payment or information request
- Stop before acting. Do not send money, provide credentials, or share sensitive information simply because the message appears polished or names someone you know.
- Find contact information separately. Look up the organization’s contact details through a source you already trust or otherwise access independently of the email.
- Contact the purported sender or organization directly. Ask whether the specific request is genuine. Use the independently obtained number or established internal route—not a number, link, or reply instruction found only in the suspicious message.
- Wait for confirmation before proceeding. If the request cannot be confirmed, do not act on it. For an organization-managed account or device, follow your workplace’s established security-reporting process.
- Report suspected financial fraud to the appropriate place. The FBI’s IC3 advisory addresses financial fraud; it is not a substitute for an employer’s channel for reporting workplace phishing. Use the reporting route that fits the incident.
The FBI also advises people not to share sensitive information with people they have met only online or over the phone, and not to send money, gift cards, cryptocurrency, or other assets to people in those circumstances. That guidance is particularly relevant when an email tries to move a conversation into a personal or unfamiliar channel or asks for an asset transfer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How account protections limit the damage
Use phishing-resistant multifactor authentication where available
A convincing email may be designed to obtain account credentials. Microsoft recommends phishing-resistant multifactor authentication (MFA) as a defense against unauthorized access using compromised credentials. MFA adds an authentication step beyond a password; phishing-resistant methods are intended to make it harder for an attacker to reuse credentials obtained through a deceptive sign-in flow.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft’s 2025 report says MFA blocks access in over 99% of cases when attackers possess valid usernames and passwords. This is Microsoft’s report figure for that stated condition, not a guarantee that MFA prevents every account compromise, payment scam, or social-engineering outcome. MFA cannot confirm that an email sender is honest, so it complements rather than replaces independent verification.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Organizations should treat email as one part of a wider defense
For organizations, Microsoft recommends enforcing phishing-resistant MFA and providing awareness training about social-engineering tactics. Training is most useful when it reinforces a repeatable action: pause at consequential requests, verify them through an independent route, and report suspicious messages through the company’s established process. The specific configuration and recovery options depend on the organization’s accounts and devices; users should follow their administrator’s instructions.
Microsoft’s report also describes email bombing as a possible precursor to social engineering, including a follow-up vishing call or impersonation in Teams. This is a broader, multi-stage pattern, not an inevitable feature of AI-written email. If a sudden flood of email is followed by an unexpected call or chat urging you to act, treat the follow-up as a separate request that also needs independent verification.
Keep AI-generated text distinct from synthetic voice, images, and video
The FBI advisory discusses more than email: it also describes synthetic images, audio, and video used in fraud and impersonation. These are related ways generative AI may support deception, but they are not the same claim as AI-generated email text. A message may be part of a wider impersonation attempt, yet the existence of synthetic media does not mean every phishing email includes it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →This distinction matters when a message is followed by a call or other contact. A voice or image that seems familiar is not, by itself, independent confirmation of an unusual request. Use a previously trusted number or organizational channel to confirm consequential instructions, rather than relying on a second contact that could be part of the same attempt.
What can be concluded—and what cannot
The evidence supports a clear practical conclusion: AI can help attackers make phishing messages more fluent, targeted, and efficient, so traditional clues such as poor grammar are less dependable. It does not establish the share of all phishing emails written with AI, a universal increase in campaign success, or an AI-only cause for Microsoft’s reported click-through difference.
For readers, the most useful response is behavior-based rather than style-based: treat a polished message as unverified when it asks for money or sensitive information, confirm the request using contact information obtained independently, and protect accounts with phishing-resistant MFA where available. For workplaces, add awareness and a clear reporting route so suspicious messages can be handled without relying on employees to diagnose how the text was produced.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
