Phishing in [2026]: Why It's Harder to Spot Than Ever

I got a phishing email last month that genuinely fooled me for about 30 seconds. Personalized, correctly formatted, referencing a real vendor I use. This is the new baseline, and the old advice about "look for typos" is dangerously outdated.

What Changed: AI-Generated Phishing

Generative AI has eliminated the typo-and-broken-English tells that used to make phishing emails identifiable. Attackers now use LLMs to generate perfectly grammatical, contextually appropriate messages at scale. More concerning: spear phishing — targeted attacks using publicly available personal information from LinkedIn, company websites, and social media — has become cheap to automate. An attack that previously required hours of manual research can now be deployed in minutes.

The New Red Flags

Urgency framing: "Your account will be suspended in 24 hours" exists to prevent you from thinking carefully. Any email creating time pressure deserves extra scrutiny. Sender address inspection: the display name can say anything — look at the actual domain. A message from "Amazon Support" at amazon-support-billing.net is not from Amazon. Hover over any link before clicking — the destination URL should match the organization's actual domain exactly.

Technical Defenses That Actually Work

Hardware security keys (YubiKey) for critical accounts make phishing attacks that capture passwords useless — the key is cryptographically bound to the actual site domain. Email clients that display full sender addresses by default. Browser extensions that flag known phishing domains. And for organizations: DMARC, DKIM, and SPF records that prevent domain spoofing.

The Human Layer

Call to verify anything unexpected involving money, credentials, or urgent action — using a number you find independently, not one provided in the message. This one step blocks almost all social engineering attacks regardless of how sophisticated the initial contact is.

My honest take: Assume every unexpected email is suspicious until you verify through a separate channel. That's not paranoia — it's just current reality.