For years, one of the easiest ways to spot a scam email was simple: look for bad spelling, strange grammar and awkward wording.
That advice is becoming outdated.
Scammers can now use artificial intelligence (AI) to create emails that are polished, professional and much more convincing. AI can help them personalise messages, imitate normal business language and remove many of the obvious mistakes that used to give phishing emails away.
Australian Government Scamwatch specifically warns that scammers are using AI to create more believable and personalised messages.
For Brisbane businesses, that means a scam email can now look every bit as professional as a genuine one.
So, if spelling mistakes are no longer a reliable warning sign, what should your staff be looking for instead?
1. Look at What the Email Is Asking You to Do
Rather than concentrating only on how an email is written, pay close attention to what it wants you to do.
Be cautious if an unexpected email asks you to:
💸 Make an urgent payment
🏦 Change supplier or employee bank account details
🎁 Purchase gift cards
📎 Open an unexpected attachment
🔑 Sign into Microsoft 365 or another online service
🔐 Provide a password or verification code
💾 Download software
📄 Send sensitive business information
⏩ Bypass your usual approval process
The Australian Cyber Security Centre (ACSC) identifies requests for money, bank account changes, unexpected attachments, login requests and suspicious links as common warning signs of business email compromise.
The question is no longer simply:
“Does this email look suspicious?”
A better question is:
“Is this request normal?”
2. Be Suspicious of Unexpected Urgency
Scammers often rely on pressure. They want you to act before you have time to check whether the request is genuine.
An email might say:
“I need this paid before the meeting.”
“Can you handle this urgently? I’m unavailable by phone.”
“Your account will be disabled today unless you sign in.”
Scamwatch continues to warn that creating urgency is a common technique used to encourage people to act without properly checking first. When urgency is combined with money, passwords, bank details or sensitive information, that should immediately trigger extra verification.
3. Ask Whether the Request Fits the Person
A scammer pretending to be your Managing Director, accountant or supplier doesn’t necessarily need to copy their writing style perfectly. They just need to sound believable.
Ask yourself:
Would this person normally ask me to do this?
If your manager has never asked you to buy gift cards before, a beautifully written email asking you to purchase ten of them should still be treated with suspicion.
The same applies to suppliers. If a supplier suddenly sends new bank account details, don’t assume they are genuine simply because the email looks professional and includes the correct company logo and signature.
Business email compromise specifically relies on criminals abusing normal business relationships and trusted processes.
4. Check the Actual Sender Address
A familiar display name is not proof of identity. An email may appear to come from:
John Smith – ABC Accounting
while the underlying email address is completely unrelated.
Scammers may also register domain names that closely resemble legitimate businesses, sometimes changing only a single letter. Take a few seconds to inspect the full email address, particularly when the message involves money, passwords or confidential information.
However, don’t rely on the sender address alone. The ACSC notes that criminals can also use compromised legitimate email accounts when carrying out business email compromise attacks.
5. Don't Trust an Email Just Because It “Sounds Right”
This is one of the biggest changes AI brings to scams.
AI can help criminals produce emails that use appropriate terminology, professional language and a tone that suits the supposed sender.
That means:
“It sounds exactly like something they would write.”
is no longer enough to prove that the message is genuine.
AI-generated content is also making other scams more convincing. Scamwatch warns that scammers can use AI to personalise messages and create fake voices, videos and websites. Treat identity as something to verify, rather than something you can recognise from writing style alone.
6. Verify Important Requests Using Another Method
This remains one of the most effective protections against sophisticated email scams.
If an email asks you to transfer money, change bank details, disclose sensitive information or do something unusual, verify the request through a separate trusted channel.
For example:
📞 Call the person on a phone number you already have
💬 Send them a new Microsoft Teams message
🤝 Speak to them in person
✅ Contact the supplier using previously verified contact details
Do not simply reply to the suspicious email or use contact information contained within it. If the original message is fraudulent, you may simply be communicating with the scammer again. A 30-second phone call can prevent a very expensive mistake.
7. Make It Easy for Staff to Report Suspicious Emails
Your employees don’t need to become cybersecurity experts. They do need to know what to do when something doesn’t seem right. Encourage staff to report questionable emails to your IT provider or internal IT team before clicking links, opening attachments or following instructions.
The ACSC specifically recommends employee training and awareness as an important defence against business email compromise.
A healthy workplace approach is simple:
If you’re unsure, check first.
It is much easier to investigate a suspicious message than to recover from a compromised Microsoft 365 account, fraudulent bank transfer or data breach.
Report Cyber Security Incidents
If your business experiences a cybercrime or cyber security incident, the Australian Government provides an online reporting service through cyber.gov.au.
The New Rule: Don't Judge an Email by Its Grammar
Poor spelling hasn’t disappeared from scam emails, but good spelling certainly doesn’t make an email safe. AI has removed one of the obvious warning signs people relied on for years.
The better approach is to look at behaviour rather than presentation.
Ask:
Is the request unexpected?
Is someone creating unnecessary urgency?
Are bank details changing?
Does money or sensitive information need to change hands?
Am I being asked to bypass our normal procedure?
Can I verify the request independently?
A perfectly written email can still be a scam.
Need Help Improving Your Business Cybersecurity?
How Computer Logic Can Help
Email scams are only one part of protecting a modern business.
Computer Logic helps Brisbane businesses improve their cybersecurity across Microsoft 365, email security, multi-factor authentication, endpoint protection, backups and general IT security practices.
We can also review your current IT environment to identify weaknesses and help you prioritise practical improvements appropriate for the size and needs of your business.
Whether you need help tightening Microsoft 365 security, reducing phishing risk, protecting staff accounts or reviewing your overall cybersecurity setup, Computer Logic can help you put sensible protections in place without making everyday IT unnecessarily complicated.
If you’re concerned about your current cybersecurity protections, or simply aren’t sure where the gaps might be, reach out to Computer Logic to schedule a complimentary discovery call on your Brisbane business.
