For years, the advice was simple: look for the typo. Scam emails gave themselves away with clumsy grammar, odd spelling and phrasing no real company would use. On October 16, 2026, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) put out a joint warning that ends that advice. Attackers now use AI to write phishing emails and texts in clean, natural language, with no mistakes to catch.
The alert was aimed at election offices and campaigns ahead of the midterms. But nothing in it is unique to elections. The same tricks work on any business with an inbox, a bank account and a team that wants to be helpful. Here is what the FBI said, why spotting errors no longer works, and the fixes that actually hold up, most of which take an afternoon.
- The FBI and CISA say AI now lets scammers write error-free phishing in any language, run bigger campaigns, and fake voices and video of real people.
- Training your team to hunt for typos no longer works. In a 2024 study, fully AI-written phishing emails got 54% of people to click, the same as emails written by human experts.
- The fixes that hold up do not depend on spotting anything: phishing-resistant sign-in for email, a rule that every money or password request gets confirmed on a second channel, and banners that flag outside email.
What the FBI said
The public service announcement, number I-101626-PSA, is titled "Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials." It is addressed to election officials, candidates and political groups, and also to the general public and to organizations in general (FBI and CISA).
It names four threats. Classic phishing, using email addresses that are nearly identical to real ones. Smishing, which is phishing by text message. AI-written messages. And deepfakes, meaning fake video and audio of real people made with AI. Election officials, the alert notes, saw a surge in phishing attempts over the last two election cycles.
One detail stands out. The FBI does not call the technology "AI" in this alert. It uses the term "super intelligence," or SI, and says SI tools let attackers write "in native languages and common vernacular," removing the spelling and grammar errors that used to flag a scam. It also says attackers use these tools in a "continuous learning process" to keep improving their automated emails.
The FBI is not asking people to look harder. It is saying there is nothing left to see.
Why the typo test is dead
This is not just a warning on paper. Researchers have measured it. In 2023, a team including Harvard's Fred Heiding and security expert Bruce Schneier sent test phishing emails to 112 students and presented the results at Black Hat. Emails written by ChatGPT alone did reasonably well, but a method designed by human experts still did better.
A year later the gap was gone. In a follow-up study, published in November 2024, the same group built a tool that researched each target online and wrote a personal email with no human help. Here is how often people clicked:
The authors say the AI emails did "on par with human experts" and 350% better than the generic ones. They also estimate AI can make phishing up to 50 times more profitable for attackers going after large groups, because the research and writing that used to take a skilled person hours now costs almost nothing. That is the real shift. Well-crafted scams used to be rare because they were expensive. Now they are cheap.
The four tricks, and what they look like at a small business
The FBI alert describes each threat in general terms. Here is how each one tends to show up in an ordinary business, and the control that stops it without anyone needing to spot a clue.
| Trick | What the FBI says | How it shows up at work | What stops it |
|---|---|---|---|
| Look-alike email | Messages from addresses nearly identical to real ones | A "vendor" emails new bank details for an invoice | Call the vendor at a number you already have |
| Smishing | Up over the past year, including through encrypted chat apps | A text or WhatsApp from "the owner" asking for gift cards | A team rule: no money moves on a text alone |
| AI-written phishing | Native language, no errors, larger campaigns | A perfect "password expiring" email from Microsoft 365 | Phishing-resistant sign-in, so a stolen password is useless |
| Deepfakes | Fake video and audio of real people | A voice call that sounds like your partner or a client | A callback, or a code word only your team knows |
Notice the pattern in the last column. Every fix works even if the message is flawless. That is the whole point. If your defense depends on a person noticing something is off, AI has already beaten it.
Where the money goes
For businesses, the most expensive version of all this is business email compromise, or BEC. That is when a scammer poses as a boss, coworker or vendor by email and talks someone into wiring money or changing payment details. According to the FBI's Internet Crime Complaint Center figures for 2025, as reported by Insurance Business, BEC cost corporate victims just over $3 billion, across 24,768 reported incidents.
BEC is exactly the kind of scam AI makes easier. The old giveaway was a "CEO" email that did not sound like the CEO. A tool that can read the CEO's LinkedIn posts and write in their voice removes that tell. A cloned voice on the phone removes the next one.
If one email can move money in your business, that is the weak spot, no matter how good the email is.
Not all sign-in protection is equal
The FBI's first recommendation is "phishing-resistant multi-factor authentication," especially for email. Multi-factor authentication, or MFA, means you need something besides a password to log in, like a code or a tap on your phone. Many small businesses already have some form of it. The catch is that most common forms can still be phished.
Here is why. A fake login page can ask for your password and your six-digit code at the same time, then pass both straight to the real site. CISA's fact sheet on phishing-resistant MFA ranks the options from strongest to weakest:
| Sign-in method | Can a fake page steal it? | CISA's take |
|---|---|---|
| Passkeys or security keys (FIDO/WebAuthn) | No | "The gold standard." The key only works on the real site. |
| Authenticator app code, or push with number matching | Yes | Best option for small businesses that cannot switch to passkeys yet |
| Push approval without number matching | Yes | Open to "push bombing," where attackers spam prompts until someone taps Accept |
| Text message or voice code | Yes | Last resort. Also open to SIM swaps, where a scammer takes over your phone number |
Passkeys work differently. Your phone or laptop holds a secret that only answers the real website, so a look-alike page gets nothing. CISA notes that "most hosted mail and SSO systems support FIDO," which includes Google Workspace and Microsoft 365, and suggests starting with email because that is where the valuable data is. It also says to start with the people attackers want most, like whoever handles payments, payroll or admin access.
What to do this month
These steps come from the FBI's list of recommendations and CISA's guidance, trimmed to what a small team can actually finish. None of them depends on spotting a bad email.
The FBI's list also covers the basics that keep everything else working: strong, unique passphrases for every account, updated software and antivirus, blocking email attachments that contain programs, and giving each person only the access their job needs (FBI/CISA).
If you get hit
Speed matters most when money has moved. The FBI asks victims to report to their local FBI field office or to the Internet Crime Complaint Center (IC3). It also recommends forcing password changes on any affected account after a breach, and writing down what happened and how you fixed it.
Where this leaves us
The FBI's alert is short, and it has no new statistics. Its importance is in what it admits. The cheapest defense we ever taught people, squinting at an email for mistakes, does not work anymore. AI writes better than most scammers ever did, and it never gets tired.
The good news is that the defenses that still work are not complicated. They just move the burden off people's eyes and onto the process. A passkey that will not log in to a fake site. A phone call before money moves. A banner on every outside email. Set those up once, and the next perfect scam email has nowhere to go.
Sources
- FBI and CISA, "Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials," PSA I-101626-PSA (Oct 16, 2026)
- CISA, "Implementing Phishing-Resistant MFA" (Oct 2022)
- Heiding et al., "Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns," arXiv:2412.00586 (Nov 2024)
- TechTarget, "Researchers put LLMs to the test in phishing email experiment" (Aug 10, 2023)
- Insurance Business, "Business email fraud drives bulk of US cybercrime losses" (Sep 22, 2026)
- FBI Internet Crime Complaint Center (IC3)