AI-Powered Phishing and Convincing Impersonation: How to Pause, Verify, and Report
AI can help criminals produce polished messages, imitate a familiar writing style, translate naturally, build realistic profiles, and continue a convincing conversation. A message with perfect grammar is not proof that it is legitimate. The FBI warns that generative AI can increase the believability and scale of fraud, while CISA notes that AI has made spelling and grammar less useful as phishing clues.
Warning signs
Treat a message as suspicious when it creates urgency, secrecy, fear, or an unusual opportunity. Watch for a sender who claims to be an executive, coworker, supplier, help desk technician, recruiter, or customer and asks you to bypass a normal process. Other signs include a slightly altered address, a newly created chat account, an unexpected document, a link whose destination differs from its label, or a request to move the conversation to another platform.
AI-enabled impersonation can also feel unusually well researched. The sender may mention public details about your role, project, travel, colleagues, or company. A long, natural conversation does not establish identity. Be especially cautious if the person asks for a login, MFA approval, payment, gift card, account change, software installation, or confidential material.
Safe steps
- Stop and preserve the message. Do not reply, click, scan a QR code, open an attachment, call a number in the message, or use its unsubscribe link. Keep the message available for reporting.
- Check the real sender information. Expand the full email address or account profile. Look for changed letters, unexpected domains, new accounts, and reply addresses that do not match the displayed sender.
- Verify through a trusted route. Contact the claimed person using a number, directory entry, bookmarked site, or existing conversation you already trust. Start a new communication. Do not use contact details supplied in the suspicious message.
- Confirm the request, not just the name. Ask whether the person sent that exact request. Follow established approval procedures for payments, access changes, file sharing, and sensitive business actions.
- Report it promptly. Use the organization's phishing report button if available, then open a security ticket. After reporting, follow local instructions about deleting or retaining the message.
- If you interacted, disconnect from the request. Close the page or file. If you entered credentials, approved MFA, installed anything, or sent information, contact the security team immediately from a known channel and explain exactly what happened.
What not to do
Do not test a suspicious link, forward the message to coworkers, continue chatting to gather evidence, or confront the sender. Do not approve an MFA prompt you did not initiate. Never disclose passwords, MFA codes, API keys, secrets, customer data, health data, financial data, source code, contracts, or confidential documents in a reply, ticket, or AI chat.
When to escalate
Escalate immediately if the message impersonates leadership or support staff, targets multiple people, requests money or access, contains a file or QR code, or appears tied to a real project. Treat any click, credential entry, MFA approval, payment, software installation, or sensitive-data exposure as urgent. If money moved, contact the relevant financial institution through an official number as well as your security team.
What to include in the ticket
Include the date and time, communication channel, displayed sender, full sender address or profile name, subject, claimed identity, requested action, and whether you clicked, opened, replied, paid, entered credentials, or approved MFA. Include the message as an attachment or screenshot only if your reporting process permits it. Provide URLs as plain text without opening them. Do not include passwords, MFA codes, secrets, or confidential content. State how you independently verified the request and any error or alert you saw.