On this page
Scam emails used to be easy to laugh at: strange spellings, odd greetings, broken English. That clue is going away. The US Cybersecurity and Infrastructure Security Agency (CISA) now warns that "in the era of artificial intelligence (AI) some emails will now have perfect grammar and spelling, so look out for the other signs." For students, that changes how to check every email.
Why doesn't bad grammar give phishing away any more?
Because large language models write fluent, personal messages in seconds. In a 2024 preprint, Fred Heiding, Bruce Schneier and colleagues tested AI-written phishing emails on 101 volunteers recruited around university campuses. Emails written entirely by AI got 54% of recipients to click, the same rate as emails written by human experts, while generic phishing emails got 12%.
The AI also did its own research. Searching public sources such as social media and personal and workplace websites, the study's tool found accurate, useful information about the target in 88% of cases. A message that mentions your college or teacher is no longer proof it is real.
The problem is growing in India too. A Press Information Bureau backgrounder from October 2025 reports that cybersecurity incidents in India rose from 10.29 lakh in 2022 to 22.68 lakh in 2024, and lists phishing among the threats on the rise.
What should you check instead of grammar?
Check the three things that fluent writing cannot fix. CISA's list of warning signs points to the same ones: urgent or emotional pressure, requests for personal or financial information, and wrong email addresses or links, such as "amazan.com".
Sender domain. Read the part after the @ in the actual address, not the display name. Anyone can type "Exam Cell" as a name. Watch for extra words, hyphens or a different ending.
Urgency. Deadlines in hours, threats to cancel your admission or account, prizes to claim today. Pressure stops you thinking.
Links. On a laptop, hover over a link and read the address that appears; on a phone, press and hold it. If the visible text and the real address differ, do not open it.
Then verify through a route you found yourself, such as a bookmarked website or the school office.
What do AI phishing emails sent to students look like?
These three examples are made up for this article. All three are written in clean, polite English.
Example 1: "Your admit card is on hold"
From: Examination Cell, admitcard@exam-cell-verification.net. "Dear Aarav, due to a mismatch in your photograph, your admit card for the upcoming exam has been withheld. Please complete re-verification within 3 hours and pay the processing fee of Rs 499 using the link below."
Domain: a generic .net address with "verification" bolted on.
Urgency: a 3-hour window, with your exam at stake.
Link: a fee paid through an email link. Open the exam's official website yourself and look for any notice there.
Example 2: "Selected for a paid research internship"
From: Dr R. Mehta, dr.rmehta.research@gmail.com. "I read your science project on solar cells and would like to offer you a paid summer internship in my lab. Please fill in your Aadhaar number and bank details in the attached form so that we can process your stipend."
Domain: a free webmail address for someone claiming a university lab. Find the person on the university's own website and write to them there.
Urgency: flattery instead of fear; the project detail could come from your public posts.
Link: an attached form asking for ID and bank details before any interview has happened.
Example 3: "Your student mailbox is full"
From: IT Helpdesk, support@yourcollege-mail.com, when your college actually uses yourcollege.edu.in. "Your mailbox has reached 99% capacity. To avoid losing incoming messages, sign in within 24 hours to upgrade your storage."
Domain: one hyphen and a different ending. It looks right at a glance.
Urgency: 24 hours and the fear of missing messages.
Link: the "Sign in" button leads to a lookalike login page that captures your password. Type your college portal's address yourself.
What should you do if you already clicked?
Don't hide it; acting quickly matters more than embarrassment.
If you typed a password, change it on the real site and turn on two-step verification.
If money left your bank account, UPI or wallet, call the national cybercrime helpline 1930. The PIB backgrounder says it helps victims of online financial fraud report quickly and, where possible, get fraudulent transactions frozen.
Report what happened on the National Cyber Crime Reporting Portal at cybercrime.gov.in.
Tell a parent or teacher, and warn friends.
Parents, one sentence does a lot here: "If any email asks you for money, an OTP or a password, show me first. You won't be in trouble."
We build AI study tools, and the same fluent language that makes a scam convincing can help you learn when it is built to teach. To see what that looks like, take a tour of Fermi's AI tutor, which teaches, explains and works through problems alongside you.
