The Experiment That Scared Me
My goal was straightforward: understand what modern AI-powered phishing looks like so I could teach clients and colleagues to recognise it. I generated three categories of phishing emails representing the most common attack vectors targeting individuals and businesses today.
Each email below is based on real documented attack patterns — the same templates actively circulating in criminal underground markets. I'm sharing them here because the best defence is recognition, and you cannot recognise what you've never seen.
"The era of spotting phishing by typos and broken English is over. AI has industrialised deception — and most organisations aren't ready."
— Arjun Sharma, Woollemia Infosec Threat ResearchWhy AI-Generated Phishing Is Uniquely Dangerous
Traditional phishing relied on volume over quality. Criminals sent millions of sloppy emails hoping a small fraction would click. AI demolishes the cost equation entirely.
Spear Phishing for Everyone
Highly targeted attacks — once reserved for nation-state actors targeting executives — can now be deployed against ordinary people. Your LinkedIn, social media, and public data can be fed into AI to craft an email referencing your name, employer, recent purchases, or location.
Psychological Precision at Scale
AI models can calibrate fear, urgency, and authority to the exact psychological thresholds most likely to trigger compliance — something that previously required skilled social engineers.
A highly personalised, brand-accurate phishing email used to take hours of skilled effort. Now it takes seconds. Attackers can produce millions of high-quality, individually tailored lures with zero expertise.
Example 1 — The Bank Account Suspension Scam
The oldest trick in phishing — but AI has made it terrifyingly polished. This email mimics a major bank's complete design system and deploys three simultaneous psychological weapons: fear (suspended account), urgency (24 hours), and authority (convincing branding).
Dear Valued Customer,
We have detected unusual login activity on your account from an unrecognized device in Lagos, Nigeria. To protect your account, we have temporarily limited access.
You must verify your identity within 24 hours or your account will be permanently closed and funds may be held for review.
Verify My Account Now →- 1 Fake domain: "chasebank-secure.notifications.com" — real Chase emails only come from @chase.com
- 2 Sent at 2:47 AM — deliberately targets sleep-deprived, off-guard recipients
- 3 "24 hours or account closed" — artificial deadline prevents rational decision-making
- 4 "Funds may be held for review" — financial fear amplifier; not how real banks communicate
This email uses triple-threat psychology. A foreign location trigger (Lagos creates immediate panic), a financial threat (frozen funds), and a countdown — each alone causes concern. Together, they override rational thinking and push toward immediate clicking. AI crafts this calibration automatically.
Example 2 — The Amazon Order Payment Hijack
E-commerce phishing has exploded because almost everyone has an Amazon account and mild background anxiety about deliveries. This email exploits existing mental context — you don't need to be specifically targeted; just having an Amazon account makes you a viable victim.
⚠️ Your payment method needs verification
Order #114-9823741-0047321 — Apple AirPods Pro (2nd Gen) — $249.00
We were unable to process payment for your recent order. Your item is being held for 48 hours. After this window, the order will be automatically cancelled and the item returned to inventory.
Please update your payment information to avoid losing your order.
Update Payment Info- 1 Domain is "amazon-orders-support.com" — not amazon.com; real Amazon only uses @amazon.com
- 2 Fabricated order number for a product you may not have ordered — creates confusion
- 3 "48-hour hold" leverages loss aversion — you'll "lose" something you never had
- 4 The "Update Payment" button leads to a fake credential-harvesting page
By citing a specific product and order number, this attack creates the illusion you nearly received something valuable and now risk losing it. Loss aversion — one of the most powerful human cognitive biases — means we feel losses roughly twice as intensely as equivalent gains. This email weaponises that perfectly.
Example 3 — Corporate IT Credential Harvest
The most dangerous category — and the one responsible for the majority of corporate data breaches. Unlike consumer phishing, this targets employees in a work context where following IT instructions is literally their job. The psychological override isn't fear of financial loss — it's fear of professional consequences.
🔒 Your password expires in 0 days
Failure to reset will lock you out of Outlook, Teams, and SharePoint.
Hi [Employee], Our system has detected that your Microsoft 365 password has expired. Accounts not reset within 2 hours will be automatically disabled and require manual IT intervention — which may take up to 3 business days to restore.
Reset Password Now- 1 External domain "it-support-yourcompany.net" — real IT always uses your company's own domain
- 2 Generic "[Employee]" greeting — real IT systems know your actual name
- 3 "2-hour deadline + 3 days to restore" — maximises professional consequences as fear
- 4 "Do not forward" — removes victim's most natural defence: asking a colleague to verify
Notice the instruction buried at the bottom: "Do not forward this email." That single line is arguably the most sophisticated element in the entire set — social engineering within social engineering. It removes the victim's most natural defence mechanism. Any email that tells you not to verify it with others is specifically trying to exploit you.
The Numbers Are Terrifying
This isn't theoretical. The convergence of AI and phishing is already reshaping the threat landscape in measurable, documented ways.
Security researchers have documented AI-generated phishing achieving click-through rates up to 60% higher than traditionally crafted lures. In controlled tests, even trained security professionals failed to correctly identify AI-generated phishing at alarming rates.
"In 2024, a successful phishing attack takes an attacker about 5 minutes and costs nearly nothing. The same attack in 2019 took hours and required real social engineering skill."
— Woollemia Infosec Threat Research TeamHow to Protect Yourself in the AI Era
The old rules are dangerously outdated. "Check for typos" and "look for bad grammar" no longer work. Here's what the Woollemia Infosec team recommends:
Verify the sender domain
"Chase Bank" in the From field means nothing. The actual email domain tells the truth — always expand and check it.
Never click email links for sensitive actions
Type your bank's URL directly. Never follow the link in the email — no matter how real it looks.
Apply the 2-minute pause rule
Any email creating panic deserves a mandatory pause. Legitimate institutions almost never require action within hours.
Verify IT requests via a second channel
Call your IT helpdesk using a number from the company intranet — not from the email itself.
Enable MFA everywhere
Even if credentials are stolen, MFA stops attackers from actually logging in. It's your last line of defence.
Use a password manager
Password managers autofill only on genuine domains — they will refuse to autofill on a phishing site.
Legitimate security emails never ask you to hide them from colleagues. If an email tells you not to ask others about it, that's precisely when you should. Forward it to your IT team immediately.
The Final Verdict
The experiment confirmed what the Woollemia Infosec research team already suspected: the quality gap between legitimate and phishing emails has effectively closed. Not because defenders have gotten worse — because attackers have gotten dramatically better, faster, and cheaper.
The three examples above are based on real, active attack vectors documented throughout 2024. AI hasn't invented them — it's made them devastatingly good at scale.
The good news? The defences are learnable. You don't need to be a cybersecurity professional to protect yourself. You need to slow down, verify the domain, never follow urgency blindly, and use MFA. Habits — not just tools — are your strongest shield.