AI killed the typo rule. Here’s how to spot phishing now.

I’m a working K-12 technology director, and the “look for typos” line was never great. Now it’s actively dangerous. A well-written email feels safe, so a polished scam sails straight past the one rule we taught everyone.

The FBI has warned that criminals use AI to make phishing more convincing and harder to detect. The grammar is no longer the signal. The good news is that what makes an email a scam was never really about spelling. It’s about the request. Teach your staff to judge the ask, not the prose.

Why the typo rule failed.

Typos were a proxy. They stood in for “a stranger wrote this in a hurry.” AI removed the proxy, and now the stranger writes like your superintendent.

Worse, the rule trained people to trust fluent writing. A clean, well-formatted email now reads as legitimate, which is exactly backwards. Polish is no longer evidence of anything.

What AI can’t fake.

These tells live in the situation, not the sentences. Any one of them is a reason to slow down.

The pressure.

Scams manufacture urgency: expires today, act now, before end of day, your account will be locked. A real emergency almost never arrives as a surprise email with a link and a deadline.

The out-of-character ask.

Your principal emailing about a schedule is normal. Your principal asking you to buy gift cards, or to “handle something quietly,” is not. When the request doesn’t fit the person, stop.

The address behind the name.

The display name is free to fake. The address is not. A familiar name sitting over an address that doesn’t end in your district’s domain is the oldest tell there is, and still the most reliable.

The payload.

A link, an attachment, a QR code or a sign-in screen you weren’t expecting. AI writes the message, but it can’t change the fact that you never asked for a password reset or a scanned file from the copier.

The unverifiable favor.

Gift cards, a change to banking or direct deposit, a wire, a password. Attackers have impersonated school officials to talk teachers into buying gift cards. Any request that moves money or credentials gets verified another way, every single time.

Replace the rule with a habit.

Don’t hand staff another checklist to forget. Give them one habit: pause, inspect, report.

• Pause when a message rushes you or makes you anxious.
• Inspect the sender’s real address and where a link actually goes.
• Report it, even when you’re not sure. Being wrong costs nothing.

The goal was never zero clicks. It’s a building full of people who pause for ten seconds and tell you when something feels off.

What to tell your staff this week.

You don’t need an assembly. One short message does it: “Scammers use AI to write clean emails now, so don’t trust a message just because it reads well. If an email rushes you, asks for money or a password, or sends a link or file you didn’t expect, stop and check another way. When in doubt, report it. You will never be in trouble for reporting.”

The writing got better. The tells didn’t move far.

AI took away the easy signal, but it didn’t change what scammers want: speed, secrecy, money or access. Teach people to watch the request instead of the writing, give them a habit and a safe way to report, and a fluent scam is just a scam that happens to read nicely.