Researchers found AI can turn public social media posts into scam emails that mention your real life, and several AI safety tools failed to stop it.
A scam email that mentions your recent trip or your upcoming concert is no longer proof that someone knows you. Researchers at the University of Texas at Arlington showed that widely available AI can pull details from public social media posts and turn them into personal phishing emails. Phishing means a fake message meant to trick you into clicking a link or handing over information.
The team showed that AI models could gather details about a person and write targeted messages from them. These could refer to things you did recently, places you visited or something you were looking forward to. The AI could also read information from photos. It could adjust the sender name, the email subject and the links to make the message look more believable.
This is called spear phishing, which means a scam built around one person's details. It used to take a scammer hours of research per target. The concern is that AI can now do much of that work, so scammers could reach large numbers of people without it.
Think about what people post casually: weekend getaway photos, concert tickets, a complaint about a service that stopped working. To friends, that is a normal update. To a scammer, it is material for a message that feels relevant. The AI is not making up facts about you. It is using what you already shared.
The researchers also asked participants to rate the AI-written emails, and they received high-quality ratings. That does not mean everyone would fall for them. It does show how convincing they can look.
AI systems already have safety tools meant to catch harmful requests. The researchers tested three of them: Llama Guard, ShieldGemma and WildGuard. At standard settings, they flagged only 0% to 19% of requests for personalized phishing. When the researchers gave the tools clearer instructions on what to look for, detection rose as high as 99%.
Anyone who posts publicly is the main target, Instagram users included. Business owners and employees are affected too, since a personal email can land in a work inbox. The research centers on information shared publicly, so tighter privacy settings reduce what is available to be used.
The alert box above lists the steps. The core idea is simple: limit what strangers can see, and never treat a personal detail in an email as a reason to trust it. If a message asks you to click, go to the company's website or app yourself instead.
The researchers will present their findings at a cybersecurity conference in March 2027. The material does not say how often scammers already use this method, or whether the makers of the three safety tools plan changes. The results do suggest the tools can improve with clearer instructions.
If an email knows personal details about you, do not trust it for that reason alone. Open the company's website or app yourself before clicking anything.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
