There is a great deal of noise about AI and fraud, most of it either dismissive or apocalyptic. The accurate position is narrower: the underlying schemes have not changed at all, but three practical constraints that used to limit them have been removed.

Fluency

Awkward phrasing and obvious grammatical errors were, for years, the most reliable phishing indicator, and they are now gone. Messages are written in correct, natural language in any target language. Every piece of guidance built on spotting bad English is obsolete, and organisations still teaching it are training people to trust well-written fraud.

Personalisation at scale

Tailoring a message to an individual — their employer, role, recent activity, colleagues — used to be reserved for high-value targets because it cost human time. That cost has collapsed. Attacks that reference your actual job, your actual manager, and a project you are actually working on are now economical to send to thousands of people.

Synthetic voice and video

Cloning a voice from a short public clip is routine. Live video manipulation is harder but has been used in large corporate frauds. The practical consequence is that recognising a voice or a face is no longer evidence of identity — see our separate article on synthetic media for the detail.

What has not changed

The money still has to move, through the same rails, to accounts and wallets that can be reported and sometimes frozen. The verification controls still work: calling back on a known number, requiring out-of-band approval for payment changes, agreeing a family code word. None of these depend on detecting whether content was machine-generated, which is exactly why they survive.

How to update your training

  • Stop teaching grammar and formatting as indicators.
  • Teach the structural signals instead: unexpected urgency, a change to payment details, a request for secrecy, a channel switch.
  • Emphasise verification procedures over detection instincts.
  • Make reporting fast and blameless, because some attempts will succeed.

The realistic outlook

Expect volume and quality to keep rising, and expect detection-based advice to keep degrading. Building your defences on process rather than perception is the only approach that does not require rewriting every eighteen months.