Security

How to spot an AI-written scam email (now that "bad grammar" doesn't give it away)

By the Keep Your Head desk · About a 6-minute read

For twenty years, the advice for spotting a scam email was some version of "look for the typos." That advice is retiring. Scammers now use the same AI tools you do, so the email is grammatically perfect, personally addressed, and written in fluent, confident prose. Here's what still gives it away — and it isn't the writing quality.

Why the old advice stopped working

The classic scam tells — misspelled words, oddly formal phrasing, a greeting like "Dear Valued Customer" — were never really about dishonesty. They were a side effect of scam operations often being run by non-native English speakers working fast, at volume, without an editor. AI removed that constraint. A scammer can now paste a rough draft into any chatbot and get back an email indistinguishable, sentence for sentence, from something your bank's marketing team would send.

Worse, AI also removed the volume constraint on personalization. Scammers can feed a chatbot scraped details — your name, employer, a recent public post, a data-breach leak — and get a message that references real specifics about you. "Generic and clumsy" used to be a tell. Neither generic nor clumsy is guaranteed anymore.

So the skill isn't dead — it just moved. You can no longer judge an email by how it's written. You have to judge it by what it's asking you to do.

The tells that still work

These don't change no matter how good the writing gets, because they're about the scam's mechanics, not its prose style:

Urgency with a narrow window. "Your account will be suspended in 24 hours." "This offer expires tonight." Urgency exists to shut off the part of your brain that double-checks things. Legitimate organizations rarely need you to act in the next hour.
A push off the official channel. The message asks you to reply to a personal email, switch to text or a messaging app, or call a number it provides — instead of you going to the app or website you already use and trust. Real institutions don't need you to leave their own front door.
An unusual payment method. Gift cards, wire transfers, and crypto show up constantly in scams and almost never in legitimate billing. No tax office, utility, or employer asks to be paid in Amazon gift cards. Ever.
A sender address that doesn't quite match. The display name might say "Bank Support," but check the actual address — a lookalike domain (bank-support-secure.com instead of the bank's real domain), an extra word, a swapped letter. This is one place worth actually looking, not skimming.
A link where the visible text and the real destination disagree. On desktop, hover over a link (don't click) and look at where it actually points, shown at the bottom of your browser or email app. On mobile, press and hold instead of tapping. If the visible text says your bank's name and the real link is some unrelated domain, that's the whole story.
A request to keep it quiet or skip normal verification. "Don't mention this to your manager yet." "Just this once, we can skip the usual approval step." Secrecy and skipped process are how scams survive contact with a second opinion.

Notice what's missing from that list: nothing about tone, spelling, or how polished the email sounds. That's the point. All six of these survive perfect grammar completely intact.

The 20-second check

When something feels even slightly off, don't investigate inside the email — leave it and verify independently:

Don't click, reply, or call any number in the message. Anything you do from inside a suspicious email plays on the scammer's turf.
Go to the source yourself, from scratch. Open your banking app directly, or type the company's website into your browser from memory (or a bookmark), or call the number on the back of your actual card. If there's a real issue, it'll be sitting there waiting for you — through a channel the scammer doesn't control.
If it claims to be someone you know — asking for money, gift cards, or a "favor" — verify through a second channel. Call them, or text a question only they'd know the answer to. Voice and video can now be convincingly faked too, so "it sounded like them" isn't proof by itself anymore.

The judgment part: AI can help you check, not just help them write

The same tool scammers use to write these can help you evaluate one. If you're unsure about a message, you can paste it into a chatbot and ask directly:

Read this email and tell me: what specific things is it asking
me to do, click, or pay? List anything that looks like a pressure
tactic, an unusual payment request, or a mismatch between the
sender name and the actual link destinations.

[paste the email text]

Two guardrails on this: strip or don't paste any personal reply-to information the email included for you specifically, and never click the email's own links to "test" them, even inside a chat tool. Paste the text, not your click.

This is a useful reversal of the whole topic: AI made scam emails harder to spot by writing, and easier to spot by analyzing. The tool didn't change sides — you just have to remember to use it on defense too.

Keep your head

Polished writing used to mean "legitimate." It no longer does. Judge the ask, not the prose — urgency, an off-channel request, an unusual payment method, a mismatched link. Those still can't fake themselves.

Get one of these a week. Our free newsletter sends one genuinely useful AI habit and one judgment check every week — no hype, four-minute read. Subscribe on the home page.