AI-written scam emails now look real, and old spam filters miss them

Scam emails no longer look like scams. Security firm Proofpoint reports that generative AI (software that writes text on demand) has erased the clumsy wording and reused templates that filters and staff used to catch. Each message can now be fluent, personal and different from the last. That weakens filters that judge mail mainly by how it looks and behaves.

What changed

Email filters were built for attackers who cut corners. Researching a target, writing well in a second language and making endless variations all took time, so attackers reused material, and the reuse left patterns. Filters learned to spot new senders, awkward language, odd timing and requests that did not fit the conversation. AI removes much of that effort, so those signals fade.

The FBI's Internet Crime Complaint Center counted more than 22,000 complaints involving AI in 2025, with nearly $900 million in losses. It also logged 24,768 business email compromise complaints, about $3.05 billion in reported losses. That is fraud where a criminal poses as a trusted contact to get money.

What it looks like

Proofpoint showed one case at its Protect 2026 conference. A single attacker wrote to more than 30 real estate agents at the same company. Each email came from a different account, asked about a different property and used different words. The questions were ordinary, such as whether a home was open for inspection. Every thread ended the same way, with a request to join a video meeting.

In one thread, an inspection question sent at 2:58 a.m. became a meeting invite 13 minutes later, marked as needing "immediate attention." The link ran through a genuine google.com address, so reputation checks saw nothing wrong. A detail in the web address then sent the click to an unrelated site.

Who it affects

Proofpoint says any business that depends on hearing from strangers is a target, including clinics taking new patients, firms signing clients, banks and insurers. Anyone who pays invoices is exposed to the bank-detail trick. The material does not say how much this changes risk for personal inboxes.

What to watch for

• A first-time contact whose small talk quickly turns into a video meeting request.
• Urgent wording that pushes you to act right away.
• A payment request to an address that differs from the sender's address.
• A page that shows a code and tells you to paste it into a sign-in page.

What to do

The steps in the alert box above cover the basics. The main point is that spotting bad spelling is no longer enough. Payment checks and account protections have to carry more of the load.

Proofpoint sells a product built on this idea, announced in September, that judges what an email is trying to get you to do. The material does not include independent tests of how well that works.