詐騙者使用 AI 後，如何識別網絡釣魚訊息

For years, the standard advice for spotting a scam message was to look for clumsy grammar, odd spelling and strange formatting. That advice has aged badly. AI writing tools now let scammers produce polished, convincing messages in seconds, tailored to the person reading them. The old tells are fading, but the underlying tricks haven't changed much — and those are what to watch for.

What AI has changed for scammers

Clean writing — messages read naturally, in the right tone, often in your own language
Personal details — information scraped from social media or past data leaks can be woven in to make a message feel targeted
Scale — one person can generate many varied messages, so you won't always see the same wording twice
Voice and video — cloned voices and altered video can impersonate someone you know or work with

The signs that still work

However well a message is written, it usually needs you to do something quickly, without checking. That pressure is the most reliable warning sign there is.

Urgency or fear — an account about to be closed, a parcel that will be returned, a payment that failed, a relative in trouble
An unusual request — gift cards, a new bank account for an existing payment, a one-time code, or remote access to your device
A mismatch in the details — a sender address that's slightly off, or a link whose real destination doesn't match the company it claims to be
A request for secrecy — being told not to mention it to anyone else is a classic manipulation tactic

Verify through a separate channel

The single most effective habit is to check a request using a route you already trust, not the one the message provides. If your bank texts you, open its app or call the number on the back of your card. If a colleague emails asking for an urgent transfer, message or call them on a contact you already have. Don't use the phone number or link inside the suspicious message itself.

Treat voices and caller ID with caution

Caller ID can be faked, and a familiar voice is no longer proof of identity. If someone calls in distress asking for money, hang up and call them back on their usual number. Some families agree on a code word for exactly this situation, which is a simple check that doesn't depend on how convincing the voice sounds.

Reduce the damage if one gets through

Nobody spots every scam, so it helps to limit what a single mistake can cost. Using a unique password for each account means one stolen password doesn't unlock the rest. Two-factor authentication — ideally an authenticator app, passkey or security key — adds a barrier even if a password is phished. And a password manager can help in a quieter way: it won't offer to fill your login on a fake site, because the address doesn't match.

A calmer way to think about it

You don't need to judge whether every message was written by a person or a machine. You only need to notice when a message is pushing you to act quickly on something sensitive, and then slow down and check. That habit works no matter how good the writing gets, and it's worth sharing with older relatives and anyone else who might be targeted.

Frequently Asked Questions

Can I still rely on spelling mistakes to spot a scam?

Not anymore. AI writing tools let scammers produce clean, natural-sounding messages in many languages. A badly written message is still suspicious, but a well-written one is no longer a sign that it's genuine.

What is voice cloning, and how is it used in scams?

Voice cloning uses a short sample of someone's voice to generate new speech that sounds like them. Scammers can use it to impersonate a relative or a manager on the phone, usually with an urgent request for money or information.

What should I do if I already clicked a phishing link?

Don't panic. If you entered a password, change it right away on the real site, and anywhere else you reused it. Turn on two-factor authentication, watch your accounts for unusual activity, and contact your bank promptly if you shared payment details.

Is a family code word actually useful?

It can be. Agreeing on a word or question that only your household knows gives you a quick way to check whether an urgent call really comes from who it claims to be, without relying on how the voice sounds.

Related reading on Guru X Blog:

Originally published at Guru X Blog. AI, security & gadgets, made simple — more at guruxurl.tech/blog.