CyberSandberg Search

Cyber AI

The typos are gone: why polished messages aren't proof

Checked

For years, a familiar tip for spotting a scam was to look for bad spelling and clumsy grammar. That tip is wearing out. AI writing tools can turn a rough scam message into a smooth, friendly, nearly error-free one quickly. A clean message no longer tells you much about who sent it.

Talk about it at home: jump to the Table Talks

That doesn't make scams impossible to spot. It means looking somewhere else: at what the message wants you to do.

What changed

In December 2024, the FBI warned that criminals are using generative AI, tools that create text, images, audio or video on request, to make their schemes more believable and to reach more people. The FBI says these tools "can correct for human errors that might otherwise serve as warning signs of fraud."

The FBI gave several examples of how scammers use AI-written text:

A year later, in an update about scammers posing as senior government officials, the FBI said: "AI-generated content has advanced to the point that it is often difficult to identify."

So a well-written message from your bank and a well-written message from a scammer can now look the same. Neither one is proof.

Judge the request, not the writing

The FTC (Federal Trade Commission) describes four signs of a scam, and none of them depend on spelling:

  1. They pretend to be from an organization you know, such as a government agency, a business or a charity.
  2. They say there's a problem or a prize: trouble with an account, a family emergency, or a prize you must pay to collect.
  3. They pressure you to act right away, before you have time to think.
  4. They tell you to pay a specific way, such as cryptocurrency, a wire transfer, a payment app or a gift card.

For more on each sign, see our Finance desk's guide, Four signs it's a scam, and what to do next.

AI can make each of these sound more convincing. It can't change what they are. A scam still needs you to do something: click, log in, pay, share a code or move to another app.

Our rule of thumb: a polished message earns a careful look, never your trust. Judge what it asks you to do, not how well it's written.

Do this now: Next time a message asks you to act, say the request out loud in plain words, such as "This text wants me to log in and confirm my card." Hearing it plainly often makes the problem obvious.

Three questions for any polished message

1. What is it asking me to do? Look past the friendly tone. Is it asking for personal information, money, a code, or a move to a different app? The FTC says honest organizations won't call, email or text to ask for your personal information, such as your Social Security, bank account or credit card numbers.

2. Did I expect this? A message out of the blue that sounds urgent deserves extra suspicion, however professional it looks. In the impersonation scheme the FBI described, scammers struck up a conversation and then asked, almost immediately, to move it to a different, encrypted messaging app.

3. Can I check it another way? The FBI's advice is to research the number or organization that contacted you, then independently find a phone number and call to confirm. The FTC says to contact a company through a website you know is trustworthy, not through a number or link in the message.

Do this now: For the three companies you deal with most (your bank, your phone company and one store), save their real phone numbers or apps where you can find them quickly.

The spelling that still matters

There's one place where small details still count. The FBI advises carefully examining the email address, phone numbers, web addresses and spelling in any message, because scammers often use slight differences, such as small changes to names and contact details, to win your trust.

So keep checking spelling everywhere, but don't stop there. A message full of typos is still a warning sign. A clean one proves nothing, and a letter-perfect paragraph can still come from an address or link with one wrong character.

When it feels personal

AI also makes it easier to write messages that feel personal. The FBI lists spear phishing, which the FBI describes as a directed attempt to trick a specific person or group, among the schemes that AI-written text helps with. It also describes scammers who open with a topic the target knows well, to build rapport, then quickly ask to move the chat to another app.

If a message seems to know you, that's not proof either. The same check applies.

When a scam moves from text to a voice or video that sounds like someone you love, a different habit helps: a family code word that verifies who you're really talking to. We cover that in A familiar voice isn't proof anymore. A family code word is.

If you already responded

If you clicked, replied or shared something, don't panic. Contact the real company using a number or app you already trust, and tell them what happened. If you typed a password, change it, and change it anywhere else you use it. Then turn on multifactor authentication (the FTC calls it two-factor authentication). If you sent money, report it right away to the bank, app or company you used to pay. Our advice: if you shared a verification code, contact that account's company right away, too. The FTC asks people to report scams at ReportFraud.ftc.gov, and the FBI takes reports of financial fraud at ic3.gov.

Do this now: Share the rule of thumb with one person in your family who reads a lot of email or texts: judge the request, not the writing.

Teach it this week

Cyber AI

If a scam message has perfect spelling, how do you spot it?

Big idea: AI can make scam messages smooth and nearly error-free, so good spelling doesn't prove a message is real. What gives a scam away is what it asks you to do.

Background for parents and grandparents: The FBI warns AI can "correct for human errors that might otherwise serve as warning signs of fraud." The FTC's four scam signs don't depend on spelling: FBI IC3: criminals use generative AI to facilitate financial fraud and FTC: how to avoid a scam.

Table Talks (10 minutes)

  • Goal: Explain why good writing isn't proof, and use the FTC's four signs on a message.
  • Start (2 min): Look at two made-up texts with the same request, one with typos, one polished. Which is the scam? (Both.)
  • Try it (5 to 7 min): AI can fix spelling. Talk through the four signs: pretend, problem or prize, pressure, pay a specific way. Kids and grown-ups label four polished made-up messages with the signs each shows, then rewrite each request in plain words.
  • Wrap-up (1 min): Everyone finishes the sentence: "I judge a message by..."

Talk it over

  1. Ask who has gotten a message that looked real but felt off.
  2. Read the rule aloud. Our rule of thumb: a polished message earns a careful look, never your trust.
  3. Practice the three questions on a made-up message: What is it asking? Did I expect it? Can I check another way?
  4. Tonight's action: share the rule with one family member.

Use made-up messages only, with no real company names, phone numbers or links; don't open real suspicious links. Free to use; please keep the source credit.

This lesson also has its own page: If a scam message has perfect spelling, how do you spot it?.

Education only, not financial, legal or tax advice. Not a registered investment adviser.

Sources

Primary sources

  1. FBI IC3: criminals use generative artificial intelligence to facilitate financial fraud, Public Service Announcement I-120324-PSA, Dec 3, 2024, date checked: Oct 24, 2026
  2. FBI IC3: senior U.S. officials continue to be impersonated in malicious messaging campaign, Public Service Announcement I-121925-PSA, Dec 19, 2025 (update to I-051525-PSA, May 15, 2025), date checked: Oct 24, 2026
  3. FTC: how to avoid a scam, consumer advice (dated July 2023 on the page), date checked: Oct 24, 2026

Supporting links

  1. FTC: What To Do if You Were Scammed, consumer advice (dated June 2026 on the page), date checked: Oct 24, 2026