Phishing emails used to give themselves away with clumsy grammar and generic greetings. Research and federal warnings over the past year show that AI is removing those tells, and that criminals are already using it.
What the research found
In a study posted November 30, 2024, researchers Fred Heiding, Simon Lermen, Andrew Kao, Bruce Schneier and Arun Vishwanath tested spear phishing emails on human subjects. Emails written by a fully automated AI tool got a 54% click-through rate, the same as emails written by human experts. The control group got 12%, and AI emails with a human in the loop reached 56%.
The AI tool also researched its own targets. The authors report that the information it gathered was accurate and useful in 88% of cases, and that AI can make phishing up to 50 times more profitable for attackers going after large audiences.
Real-world data points the same way. KnowBe4 analyzed phishing emails sent between September 15, 2024 and February 14, 2025 and found that 82.6% showed some use of AI. It also found that 76.4% of phishing campaigns used polymorphic tactics, meaning small variations from one email to the next that help messages get past filters.
What the FBI is warning about
In December 2024 the FBI warned that criminals use generative AI to make fraud more believable, including using it to avoid the grammar and spelling mistakes that once gave scams away. It described cloned voices used to impersonate relatives in a crisis and deepfake video used to impersonate executives in video chats.
In May 2025 the FBI reported an ongoing campaign that used text messages and AI-generated voice messages to impersonate senior U.S. officials.
The losses are real. The FBI's 2024 Internet Crime Report counted $2.77 billion in business email compromise losses from 21,442 complaints, and $16.6 billion in total reported internet crime losses. Reported losses from all types of internet crime reached $87.4 million in Louisiana, $65.6 million in Mississippi and $103.8 million in Alabama.
How to defend your business
AI makes a convincing email cheap to produce, so the defenses that matter most do not depend on spotting bad grammar:
- Verify any request to send money, change banking details or share credentials by calling a known number, not one in the message. The FBI advises hanging up and researching the contact yourself.
- Agree on a verification phrase or callback process for urgent payment requests. The FBI recommends a secret word for families, and the same idea works for a finance team.
- Turn on multifactor authentication for every account that allows it, and never disable it, as the FBI advises.
- Update security awareness training with AI-written examples, and run regular phishing simulations.
- Use email filtering that looks at behavior and context, not only known bad links, since polymorphic campaigns change from message to message.
- Report fraud to the FBI's Internet Crime Complaint Center.
WITTCO provides email security and phishing simulation training for small businesses, so your team sees realistic AI-written lures in practice before a real one lands.
Sources
- arXiv (Heiding, Lermen, Kao, Schneier and Vishwanath), "Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects" (November 30, 2024): https://arxiv.org/abs/2412.00586
- KnowBe4, "New KnowBe4 Report Reveals a Spike in Ransomware Payloads and AI-Powered Polymorphic Phishing Campaigns" (March 20, 2025): https://www.knowbe4.com/press/new-knowbe4-report-reveals-a-spike-in-ransomware-payloads-and-ai-powered-polymorphic-phishing-campaigns
- FBI Internet Crime Complaint Center, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud" (December 3, 2024): https://www.ic3.gov/PSA/2024/PSA241203
- FBI Internet Crime Complaint Center, "Senior US Officials Impersonated in Malicious Messaging Campaign" (May 15, 2025): https://www.ic3.gov/PSA/2025/PSA250515
- FBI Internet Crime Complaint Center, "2024 IC3 Annual Report" (2025): https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
