Notable Source
ES Book a call
← All articles

Security · Article 8 of 10

Fake emails made with AI: how to spot them in 2026

Alejandro PeñuelaOctober 20266 min readEspañol →

A sealed envelope whose wax seal looks perfect but has a small crack.
Image made with AI

Spelling mistakes used to give fake emails away. Not anymore: the FBI warns that criminals use AI to write convincing messages, tailored to you, with proper grammar. What still works is checking what the email asks for. Money, passwords, codes or new bank details? Confirm through another channel before you do anything.

The old trick stopped working

For years the advice was "look for typos." In May 2024 the FBI warned that criminals use AI to "craft convincing messages tailored to specific recipients and containing proper grammar and spelling," and to clone voices and videos of people you trust.1

The numbers in the United States show the size of the problem. In its 2025 annual report, the FBI's Internet Crime Complaint Center received 1,008,597 complaints, with $20.877 billion in reported losses. Business email compromise alone cost about $3.05 billion, and there were 191,561 complaints of phishing and spoofing. More than 22,000 complaints mentioned AI. The report says AI-generated content "is becoming increasingly difficult to detect and easier to make."2

Five checks that still work

  1. Look at what it asks, not how it's written. Pay a supplier, change a bank account, send a code, sign in through a link, buy gift cards. That's the signal, however polished the email looks.
  2. Check the sender's real address, not just the name. A letter changed or an extra word in the domain is enough.
  3. Distrust the rush. "Today," "before 5 p.m.," "or your account will be closed." Urgency is there so you don't stop to check.
  4. Confirm through another channel. If an email or a voice note asks for money or new bank details, call back a number you already had, not the one in the message. The FBI recommends exactly this: verify the authenticity of digital communications, especially requests for money or sensitive information.1
  5. Never share a sign-in code you didn't request. And turn on two-step verification, which the FBI also recommends.1
Try it

From: Proveedora de Insumos SAS <>

Subject: Urgent: new bank account

Hello,

After an internal audit . Please pay invoice 2291 to the new account

To confirm, with .

Thank you,
Payments team

You found 0 of 5

  1. Check the sender's real address, not just the name: compare it with the emails this supplier has sent you before.
  2. Look at what it asks: changing the bank account is the signal, however polished the email looks.
  3. Distrust the rush: the urgency is there so you don't stop to check.
  4. Confirm through another channel: call a number you already had; don't reply to this email.
  5. Never share a sign-in code you didn't request.

Made-up example.

Find the five signs in this email from a made-up company.

What to do if you already clicked

Change the password of that account from a device you trust, sign out of all sessions, warn your bank if you paid or shared card details, and tell your team so nobody else clicks.

Ask me how we do it for your business, on a free 30-minute call.

General information, not legal advice. Figures are from the United States.

Charted and signedOctober 2026 · Alejandro Peñuela
Every claim in this article points to its source.