Once upon a time, it was relatively easy to spot an email scam. They were flawed. Bad grammar, broken formatting, poor spelling and typos, and a sort of odd cadence often referred to as "Engrish" exposed them for what they were: attempts to extract money from "rich" Americans, most commonly by people outside America. Often the scams seemed reasonable, except when they weren't, as with the famous Prince of Nigeria scam: send me a couple thousand dollars so I can release my $1.7 million account, and I'll split it with you. And for a little while they worked, until people's reason caught up with their greed.
They were profitable for scammers, who could send an email to thousands of people in hopes that maybe ten would fall for the scam. And they did. But more scammers got into the business, and as the market grew crowded, the suckers grew scarcer. The scams had to get better in order to turn a profit.
So they did.
A Near Miss
A true story, changing details for anonymity: A friend called me yesterday. She's a long-time cybersecurity expert and very good at what she does. She had been following instructions in emails from her company's CEO and was growing suspicious.
It was a strange day; the branch of her company was shut down due to the winter storm that many of us saw over the weekend, and she was teleworking, which in her case meant hardly working, as much of her job was hands-on and had to be done from the office. She received an email from her CEO, who worked many states away; the CEO needed seven gift cards for surprise bonuses to reward a few people for outstanding work. The email, coming in on her phone, looked legit: branding correct, grammar correct, and emailed out of necessity because the CEO was in and out of meetings that day. The gift cards, explained the CEO, had to be physical; she had experienced issues with e-cards. And she'd put off purchasing these cards herself — a mistake, she admitted — until it was nearly too late. She needed them that day.
So my friend set about locating the cards, driving out to the place where they were sold, and then something in her brain put the brakes on: Does this make sense?
No.
Real executives don't pre-emptively justify their decisions or excuse their procrastination. They have assistants to pass things to. This is when she called me, mostly to have another brain to talk things out. And I pointed out a few more things. Real executives don't expect people to purchase things like this from their personal funds; they find people with corporate credit cards to do it. They don't bypass finance or human resources. They don't operate with email only. And they certainly don't effuse gratitude in their phrasing: "I'd like to thank you profusely for your dedication and hard work. It means a lot, and I know I can trust you with this sensitive task." No, a CEO just tells you to make it so.
My friend politely emailed back to request that her CEO use the Slack channel just to verify this was legitimate.
And she got crickets. It was, indeed, a scam, caught just in time.
My Secret Superpower
I saw something was off almost immediately, but not because I’m smarter than my friend. She’s extremely smart. And not because I know more about cybersecurity. She knows far more about it than I do. I caught it because I have a secret superpower.
I used to be a secretary.
Secretaries are often treated as low-level functionaries. In reality, they’re the people who actually run the place. They manage access and flow. They know who talks to whom, through which channels, and for what kinds of requests. Through daily exposure, they learn how authority really behaves, not how it’s described in org charts. They see patterns. They see exceptions. And they know when something doesn’t fit.
When I heard the details of the message my friend received, it didn’t feel wrong in a technical sense. It felt wrong in a human one. The tone didn’t match the role. The politeness was excessive, explanations unnecessary, gratitude misplaced and effusive. It sounded like someone performing what they thought a CEO sounded like, not how CEOs actually communicate.
It was AI.
AI can now write clean prose, mimic formatting, branding, even voice. What it still struggles with is authenticity. It hasn’t been in the room. It hasn’t watched executives issue short, blunt directives and move on. It hasn’t watched assistants intercept nonsense before it ever becomes a request. That’s where this scam failed: the moment someone stepped outside the original channel and tried to verify reality elsewhere. In essence, it broke an enchantment, the story that had been woven. And it changed the narrative, just as when the child called out the emperor's new clothes for what they were: nothing.
Online Scams Have Changed
Scams used to be fairly obvious, once you saw what to look for. But technology has made the old tells obsolete.
Back in the Prince of Nigeria days, scams were easy to spot because good writing was expensive. Most scammers wrote badly, and their bad writing became the warning label. AI has removed that label. Today, it costs almost nothing to generate clean, professional emails at scale. Logos are easy to find and copy. Formatting is trivial. Personalization can be automated using publicly available information. LinkedIn alone provides enough data to map organizations, identify plausible targets, and locate contact information. With AI agents, you can even automate this.
Modern scams feel different. They don’t sound foreign or desperate. They sound boring. Routine. Administrative. Like legitimate work email.
The Prince of Nigeria scam promised wealth. That was its mistake. Modern scams promise normalcy. They ask you to be helpful, efficient, responsible. They rely on your desire not to be the one who slows things down.
And this goes far beyond the workplace.
Your church emails that there’s a family in need of groceries and they hope they can count on you for a hundred-dollar gift card. Your grandchild emails saying they’re in trouble, they need help getting out of jail, and please don’t tell Mom. Your CEO wants to surprise someone with a bonus and asks for help making it happen.
The amounts are small. The requests are plausible. And like anyone, you want to help. None of these scenarios is absurd. That’s the point. Modern scams don’t ask you to suspend disbelief. They ask you to suspend verification, and they manipulate you into doing it by stealing trust and exploiting your emotions.
Why Smart People Are Now More Vulnerable
Don't think you're too smart to fall for this, either. Intelligence is no longer the shield people think it is. In fact, it's another weak point scammers exploit.
Smart, competent people are trusted to move quickly, cut through red tape, and handle things discreetly. Those are strengths in real work environments. But because urgency and efficiency also keeps you from thinking about things twice, your competence has become a tool for scammers.
The old scams targeted greed. The new ones target responsibility. They flatter reliability and assume competence. And capable people are less likely to stop and ask obvious questions, because obvious questions feel inefficient.
Intelligence doesn’t protect you from social engineering. It just makes the scams work faster.
The New Tells
If bad grammar is no longer the giveaway, then what is?
The answer isn’t technical. It’s human.
Modern scams tend to fail in the same places, not because the writing is sloppy, but because the writer doesn’t understand how real institutions and relationships function.
Authority mismatch is the first tell. Powerful people don’t over-explain. They don’t apologize for delegating. They don’t narrate their inconvenience. Excessive gratitude and justification are red flags.
Process violations are the second. Money in real organizations moves through boring channels. Finance exists for a reason. HR exists for a reason. Requests that bypass both, especially when they involve personal funds or unusual payment methods and odd requests — like buying physical cards but just sending the data on the card to the person you're helping — should stop you cold.
Channel dependence is the third, and most important. Scams survive by keeping you inside one communication stream. Any story that collapses when you try to verify it elsewhere isn’t real. Change the channel, and the illusion either holds — or it collapses.
The One Thing to Do to Protect Yourself
Change the channel. Or, as Reagan famously said, trust but verify.
If a request involves money, urgency, or secrecy, step outside the original communication path before acting. Call a known number. Message them through a different platform. Ask a third person who would normally be involved: HR, a secretary, or accounting.
This doesn’t require technical skill. It works when you’re tired, busy, or on your phone. It works because real people exist in more than one place. Scammers don’t. They depend on speed, confusion, and that single point of contact.
Never purchase gift cards, wire money, or send digital payments without independent verification. Never use personal funds for company business. Never treat urgency as a reason to skip normal processes.
The fix here isn’t better software. It’s better habits.
Phishing scams didn’t become more dangerous because people became dumber. They became more dangerous because they stopped looking stupid or fake. AI erased the easy tells. What remains are the human ones: mismatched authority, broken processes, and stories that fall apart when exposed to reality.
Remember one thing: real requests survive verification. Real people don’t mind being checked.
So when something feels off, don’t argue with the email.
Step outside it. Change the channel.
Editor’s Note: PJ Media is here to make our culture great again, rather than fearful and false, and to help you with news you can use. Join PJ Media VIP and use the promo code FIGHT to get 60% off your VIP membership!
Join the conversation as a VIP Member