Quick answer: To spot an AI powered phishing email, ignore how polished it looks. Check the sender, where the link really goes, what it’s asking for, and how urgent it feels, all through a separate channel. Real banks don’t ask for full passwords, PINs, or one time codes by email.
The old advice was simple: look for bad spelling and strange grammar. AI has broken that test. In 2026, a scammer can write a clean message in perfect US or UK English, copy a bank’s tone, personalise it with details from social media, and send a convincing warning to thousands of people at once.
That doesn’t leave you powerless. The message looks better, but the scam still runs on the same trick. It needs you to act fast, through a link, an attachment, a phone number, or a reply that the criminal controls. These seven checks focus on behaviour, not typos. For more protection guides, browse our Cybersecurity section.
Why AI phishing is harder to spot
What has changed
- Language: Messages can be fluent, local, and specific. Details like “card ending in” can be guessed or pulled from a data breach.
- Design: Logos, layouts, and signatures are easy to copy from real emails and websites.
- Personalisation: Public posts, job details, and breached data can make a message feel properly researched.
- Voice and follow up: The scam may continue by phone or text, with a script that sounds calm and professional.
The US Federal Trade Commission’s core advice still holds up. If a message asks you to click or open something, contact the company using a number or website you already know is real, not the details in the message. Read the full guidance in the FTC guide to recognising and avoiding phishing scams.
7 signs a bank email is fake
1. It creates a deadline before you can think
“Your account will be closed today.” “A payment will leave in 30 minutes.” Urgency is the engine of phishing. A real fraud alert can be time sensitive, but you can still check it safely by opening the official app or calling the number on your card. The few minutes you spend checking are the protection, not the problem.
2. The sender address is almost right
Look past the display name. A message can say “Chase Security”, “Barclays”, or “HSBC” while the real address uses an unrelated domain, extra words, or a look alike spelling. On a phone, tap the sender’s name to reveal the full address. Just remember, even a correct looking address isn’t proof on its own.
3. The link goes somewhere you can’t clearly identify
On a computer, hover without clicking. On a phone, long press carefully if your mail app offers a safe preview, or simply don’t use the link at all. Shortened links, long strings of subdomains, and a login page that looks slightly off are all reasons to stop. Type the bank’s address yourself, or use its official app.
4. It asks for a secret your bank shouldn’t need by email
Full passwords, card PINs, CVV codes, one time passcodes, remote access to your device, or a request to move money to a “safe account”. These are major red flags. A bank employee might check limited details on a call you placed, but email should never be where you hand over the keys to your account.
5. The story doesn’t match your real account activity
Maybe you don’t even hold an account with that bank. Maybe it mentions a branch, product, currency, or transaction type you never use. US customers might see a UK sort code reference. UK customers might see a US routing story. Scammers reuse campaigns across countries, and local details that don’t fit are valuable clues.
6. The attachment or QR code is the real payload
An unexpected “statement”, “secure document”, invoice, or QR code can lead to a credential harvesting site or to malware. QR codes are especially tricky, because the destination stays hidden until your camera opens it. Don’t scan a code from an unsolicited financial email. Go to the official app instead.
7. It tries to keep you inside the message
Fake messages often supply their own reply address, phone number, and chat link, plus instructions not to call the normal line because it’s “busy” or “compromised”. That isolation is deliberate. Break the script. Close the email and contact the organisation yourself.
A 60 second checklist before you click anything
- Pause: Does the message want speed, secrecy, or fear?
- Sender: Is the full address exactly what you’d expect?
- Destination: Can you reach the same alert through the official app or a typed website?
- Request: Is it asking for a password, PIN, code, payment, or remote access?
- Context: Do the account, amount, product, and country details match your real life?
- Independent check: Have you contacted the bank outside the message?
If any answer makes you uneasy, treat the message as suspicious. You don’t have to prove it’s fake before you protect yourself.
What we tell our own families
We’ve had this conversation at our own kitchen tables, and one rule works better than any technical check. Nobody in the family clicks a banking link from an email. Ever. The app is the front door, the email is not.
It sounds strict, but it removes the whole decision. You don’t have to judge whether a message looks real at 7am, half awake, with the kettle on. You just open the app, the way you always do. If there’s a real alert, it’ll be waiting there. In our experience, this one habit has ended more “is this real?” panics than every other tip in this guide combined.
What to do in the United States
If you’ve received a phishing email, the FTC advises forwarding it to the Anti-Phishing Working Group and reporting the attempt through its fraud reporting route. The FTC guide linked above lists the current steps. If you entered any information, contact your bank right away using the number on your card, change the affected password from a safe device, turn on two factor authentication, and watch your statements.
If a scammer may have enough details for identity theft, act quickly and keep records of calls, case numbers, and letters. Speed matters, but use official contact routes, not numbers from the suspicious message.
What to do in the United Kingdom
UK readers can forward suspicious emails to the National Cyber Security Centre’s Suspicious Email Reporting Service at report@phishing.gov.uk, then delete the message. The NCSC also warns that scammers work hard to gain your trust and pressure you into acting without thinking. Its guidance is summarised in this NCSC guide to spotting scam contact.
If money may have left your account, call your bank first, using the number on your card or its official app. Keep evidence, but don’t keep talking to the scammer to “gather proof”.
Protect yourself before the next message arrives
- Use a unique password for email and banking, stored in a reputable password manager.
- Turn on two factor authentication, ideally with an authenticator app or a security key for important accounts.
- Keep your phone, browser, and banking apps updated.
- Set transaction alerts, so real activity is easier to compare with a suspicious claim.
- Trim the public personal details that help scammers personalise a message.
- Agree a family code word, in the US or the UK, in case relatives get AI voice or emergency money scams.
These habits sit nicely alongside good software choices. Our Software guides include free tools that help you organise passwords and security without another expensive subscription.
The bigger lesson for businesses and website owners
Customers are learning to distrust email that looks perfect. So make verification easy. Publish clear contact routes, use consistent domains, tell customers what you’ll never ask for, and avoid sending login links when an app or a typed address will do. Clear public information also helps AI search systems describe your business correctly. That’s the same principle behind our guide to getting cited in Google AI Overviews.
Frequently Asked Questions
Can AI phishing emails have perfect spelling?
Yes. Perfect spelling and grammar no longer prove a message is genuine. Check the sender, the destination, the request, and the story through an independent channel instead of judging the writing.
What if I clicked the link but didn’t enter anything?
Close the page, don’t download anything, and update and scan your device with its built in or reputable security software. Contact your bank if the page looked like a login screen, or if you notice anything unusual. Change passwords if there’s any chance information was entered.
Will my bank ever ask me to move money to a safe account?
Treat any request like that as a scam warning sign. Stop the conversation, hang up if you need to, and call the bank on the number on your card or through the official app. Don’t use contact details from the message that made the request.
Should I reply and ask if the email is real?
No. Replying confirms your address is active and keeps you inside the scammer’s script. Verify independently, report the message through the route for your country, and delete it.
Final Takeaway
AI has made phishing prettier, not legitimate. Slow down, leave the message, and verify through the official app, a typed website, or the number on your card. That one habit defeats most fake bank emails, whether they land in New York or Newcastle.
Received a suspicious message and want a second opinion? Don’t forward passwords or codes. Ask us a general safety question via Contact TechPure, and follow Tech News for new scam patterns.
