The Typo Test Doesn't Work Anymore
Here's a question for you. If someone asked how you spot a scam email, what would you say?
A lot of us would say, "Easy. Look for the spelling mistakes." And for years, that worked pretty well. Clumsy grammar and odd wording were a dead giveaway.
But as we saw in Level 1, AI has changed things. The UK's National Cyber Security Centre has warned that AI tools make it easier for criminals to write messages with fewer spelling and grammar mistakes. So a scam can now land in your inbox looking neat, polite and properly written.
The good news is that perfect spelling only fixes how a scam looks. It doesn't change what the scam wants. That's where we're going to catch it.
Meet a Polished Fake
Let's look at an invented example. Imagine this lands in your inbox:
From: FlixNest Billing Subject: Margaret, your membership will be paused today
Hi Margaret,
We couldn't take your monthly payment for your FlixNest plan in Shrewsbury. To avoid losing access to your saved shows, please update your card details within 2 hours.
[Update payment now]
Attached: Invoice_October.zip
There's not a single typo. It uses Margaret's name and her town. It sounds calm and professional.
So is it real? Let's check it together.
Check One: Who Really Sent It?
The name at the top, "FlixNest Billing", is just a label. Anyone can type any name they like there. It's a bit like writing "The Queen" on the back of an envelope. It doesn't make it true.
What matters is the actual email address hiding behind the name. On a computer, hover over or click the sender's name. On a phone, tap it. In our example, the real address turns out to be something like billing@flixnest-accounts-help.co. That's not the company's real address. Watch out for extra words, odd endings, or letters swapped to look alike.
Check Two: Where Does the Link Really Go?
The button says "Update payment now". But the words on a button can say anything. What counts is where it actually takes you.
On a computer, rest your mouse pointer over the link without clicking, and the real web address usually shows up in the bottom corner of the screen. On a phone, pressing and holding a link often shows a preview of the address. Again, be careful not to just tap it.
If the address doesn't match the company, or looks like a jumble, don't go there. And here's a habit that beats every trick: if you're worried about your account, close the message and go to the company yourself, using their app or a website address you already know.
Check Three: Did You Expect That Attachment?
What about Invoice_October.zip? Ask yourself, "Was I expecting a file from them?" Unexpected attachments, especially zipped files or anything asking you to "enable" something once it's open, can hide harmful software. If you didn't ask for it, don't open it.
Warning Signs That Don't Depend on Spelling
Now for the clues AI can't polish away. Every scam has a job to do, and that job leaves fingerprints.
Pressure. "Within 2 hours." "Today only." "Final warning." Scammers rush you because a rushed person doesn't stop to check. Real organisations rarely give you a ticking clock.
Odd requests. Being asked to type in card details, share a password, read out a code, or pay in an unusual way should make you pause, however nicely it's asked.
Personal details used to sound genuine. This one's sneaky. Seeing your name, your town or even your child's school can make a message feel real. But those details are often easy to find online or have leaked in past data breaches, and AI can weave them in within seconds. Knowing your name doesn't prove someone is who they say they are.
Something just feels off. Maybe a friend's email sounds stiffer than usual, or a company writes to an address you never gave them. Trust that little nudge.
What About Texts?
The same checks work for text messages too. Picture a text that says: "Your energy refund of £86.40 is ready. Claim before midnight:" followed by a link. Pressure? Yes. A link you didn't expect? Yes.
So what should you do? Three simple steps, in this order:
- Don't reply and don't click. Not even to type "STOP". Replying can tell the sender your number is live.
- Forward it to 7726. It's free with most UK mobile providers. The numbers spell "SPAM" on your keypad, which makes it easy to remember. Your provider can then look into the sender and block them.
- Delete it. Report first, then delete.
One small note: 7726 is for ordinary text messages. If a scam turns up on WhatsApp or another messaging app, use that app's own block and report buttons instead.
Got a suspicious email instead? You can forward it to the NCSC at report@phishing.gov.uk, and then delete it.
Key Takeaways
- Perfect spelling no longer means a message is safe. AI can write clean, personal scams.
- Check the sender's real address, not just the display name.
- Hover over or press and hold a link to see where it really goes, and never open attachments you weren't expecting.
- Watch for pressure, odd requests and personal details used to win your trust.
- Scam text? Don't reply or click, forward it to 7726, then delete it.