For twenty years, ordinary people were taught a practical skill: spot the scam by its seams. The misspelled company name, the greeting that said dear customer, the phrasing that read like a bad translation, the urgency that overplayed its hand - these were the reliable fingerprints of mass-produced fraud, and training people to notice them genuinely worked. That skill is now close to worthless, and it is worth saying so plainly. Attackers have adopted the same AI writing tools as everyone else, and security researchers tracking current fraud campaigns describe messages that are fluent, correctly formatted, tonally appropriate, and personalised to the recipient - referencing the right colleagues, the right projects, the right suppliers, in the right register. The typo tell did not fade; it fell off a cliff.
The change is not just polish but personalisation at scale. What once required a patient criminal researching one target can now be done in volume: public information about a business - its staff, its customers, its recent announcements, its way of speaking - can be turned into individually tailored messages by the thousand. The message that arrives does not look like spam that slipped through; it looks like a normal email from a normal counterparty on a normal day. Voice adds a further edge, with cloned speech turning the reassuring phone call into another forgeable artifact. The overall effect is that the surface of a communication - how it reads, how it sounds, how professional it looks - now carries almost no information about whether it is genuine. Fluency has become cheap for everyone, honest and criminal alike.
What deserves emphasis is that the defenses that still work were always the right ones - the tell-spotting was a convenient shortcut layered on top of them. A request's legitimacy was never actually proven by its grammar; it is proven by verification through a channel the requester does not control. The bank details change is confirmed by calling the supplier on the number you already had, not the one in the email. The urgent payment instruction from the boss is checked with the boss directly, by a route the message did not provide. The unexpected login alert is investigated by going to the site yourself, never through the link. These procedures are indifferent to how well the scam is written, which is precisely why they survive the era in which every scam is written well.
For a business, the practical task is to retire the old training and institutionalise the surviving rules. Staff should be told directly that polish means nothing now - that the absence of red flags is not a green flag - because people who were taught to look for clumsiness will extend trust to fluency unless explicitly untaught. In its place go a small number of hard procedures: any request that moves money, changes payment details, shares credentials or urgently bypasses normal process gets verified out-of-band, every time, regardless of how routine or well-written it appears, and no one is ever penalised for the delay verification costs. The scammers' writing has improved beyond detection. The good news is that the strongest defenses never depended on detecting it - and the businesses that lean on procedure rather than intuition lose nothing at all from the change.