Do not rely on spelling mistakes to spot a scam. CISA's guidance says perfect grammar is not a reliable sign, because AI can produce flawless messages. Look instead for urgency, requests for personal or financial information, shortened links and wrong addresses, then verify through a channel you already trust.
Signs that still work
CISA's page on recognizing phishing lists these:
- Urgent or emotional language, or threats of dire consequences if you do not respond.
- Requests for personal or financial information.
- Untrusted shortened URLs.
- Incorrect email addresses or links, such as a misspelled brand name like amazan.com.
Notice that none of these depends on poor writing. They describe what the message wants from you.
The three step response
CISA describes three steps.
- Resist. Do not click links or attachments that seem too good to be true or try to get your personal information. Report the message using the option near the sender's name or the report spam button.
- Delete. Remove the message. Do not reply and do not click anything, including unsubscribe links.
- Verify independently if it could be real. Do not use the links or phone numbers in the message. Type the company's address yourself, or contact the person through another method you already trust.
What AI changes and what it does not
It changes the quality of the prose. A scammer no longer needs to write well, translate well or know your local expressions. Messages can also be tailored in volume.
It does not change the goal. Scams still want you to hurry, to share something or to move money. They still arrive from addresses and links that do not belong to the real sender.
Habits for a household
- Agree on a family word for urgent requests by phone or message, so a voice or text claiming to be a relative can be checked.
- Never act on a request for money or codes without calling back on a known number.
- Treat any message that asks you to log in as a reason to open the site yourself instead.
- Tell older relatives and teenagers that good writing is not proof. Say it plainly and often.
- Report, then delete, and tell someone if you clicked.
If you clicked
Change the password for that account from a clean device, turn on multifactor authentication and watch for unusual activity. If money or card details were involved, contact your bank through the number on your card.
Quick check
Is a well written email safe?
Not necessarily. CISA says perfect grammar is not a reliable sign because AI can produce flawless messages.
Should I use the link in the message to check if it is real?
No. Go to the company's website by typing the address yourself, or contact the sender another way you trust.
Sources
Last reviewed: 19 October 2026.
