For about twenty years, we taught people to spot phishing by its mistakes. Misspelled words, odd phrasing, a greeting that didn’t sound like anyone you know.
That tell is gone.
What changed
AI tools can now write a clean, professional, well-formatted email in seconds. They can match an organization’s tone using nothing more than what is on its public website: the way it describes its programs, the names of its staff, the events on its calendar.
The grammar mistake was never the attack. It was just the part that happened to be easy to notice. Take it away, and the attack is exactly as dangerous as before, only harder to see.
Two newer tricks worth knowing by name
Quishing: phishing by QR code. A QR code hides its destination until you have scanned it, and phones make the resulting web address hard to read. Nonprofits should pay particular attention, because QR codes are everywhere in this sector: event signage, donation materials, table tents, handouts. We have trained people to scan them without thinking. At an event, a sticker placed over a real code takes seconds and is hard to spot.
Two small habits help. When you scan a code, read the address your phone shows before you open it. And if you put QR codes on your own materials, check before doors open that nothing has been stuck over them, and print the plain web address underneath so people have another way in.
Fake CAPTCHA pages. This technique is known as ClickFix. A page looks like a routine “verify you’re human” check, then shows a short set of steps: press Windows+R, press Ctrl+V, press Enter. What you have just pasted is a command the page quietly copied to your clipboard. Pressing Enter runs it on your computer. Microsoft’s security team has a detailed write-up if you want to see how it works.
One rule covers this completely: no legitimate verification step will ever ask you to paste something into your computer. If a page asks, close it.
What replaces the old tell
Stop judging how a message looks, and start judging what it asks you to do. Four questions do most of the work:
- Does it create urgency?
- Does it ask you to skip a normal process?
- Does it move you to a different channel, such as a text, a personal email, or a new phone number?
- Does it want credentials or a change to where money goes?
A message can be perfectly written and still answer yes to all four. Polish tells you nothing now. The request still tells you everything.
If you already clicked
If you followed steps like the ones above, or entered a password on a page that turned out to be fake, tell someone right away. Don’t wait to be sure, and don’t try to fix it quietly. The first hour matters far more than the embarrassment, which is exactly what the next post is about.
This week’s action
Look at your phishing awareness training. If it still teaches people to look for spelling and grammar mistakes, update it to focus on behavior instead: what the message asks for, and how to verify it.
Next in this section: write the callback rule down.