The "obvious" phishing email — broken English, generic greeting, glaring spelling errors — is increasingly the exception rather than the rule. Modern phishing campaigns are better written, better targeted, and harder to catch by instinct alone.

What's changed: Attackers now routinely use AI writing tools to produce grammatically correct, contextually appropriate messages. Combined with information gathered from LinkedIn, company websites, and previous breaches, phishing emails can reference real vendor names, real project details, or a real colleague's actual communication style.

The result: Traditional advice — "look for spelling mistakes" — is no longer a reliable defense. Staff need updated guidance based on what modern phishing actually looks like.

What to train on instead:

• Unexpected requests, even from a familiar name or a legitimate-looking domain — verify through a separate channel before acting
• Links that don't match the text they're attached to (hover before clicking, on desktop; on mobile, be extra cautious with any link in an unexpected message)
• Any message creating artificial urgency around money, credentials, or access — regardless of how well-written it is
• Slightly altered domains (a single added letter, a hyphen, a different top-level domain) that are easy to miss at a glance

Recommended actions:

• Update phishing awareness training to reflect these patterns, not just outdated "spot the typo" guidance
• Run periodic simulated phishing tests to measure actual staff readiness, not assumed readiness
• Enforce MFA everywhere, so a phished password alone isn't enough to gain access
• Encourage a "verify, don't apologize" culture — staff should never feel embarrassed for double-checking a suspicious request