This article has been reviewed according to Science X's editorial process and policies. Editors have highlighted the following attributes while ensuring the content's credibility: A text from your neighborhood gardening club friend Ben offering a deal on seeds might seem too specific to be a scam. But that kind of personalization is exactly what can make phishing messages convincing.
Scammers are doubling down on an evolving method called spear phishing—using personal information such as a job, co-worker, hobby, social media posts or even voice—to create compelling messages that encourage people to click on a link. Some 90% of corporate hacks originate from spear-phishing attacks. To make matters worse, scammers are now using AI agents to generate deceptive phishing attacks en masse.
Recent BYU research examined AI-generated deception across text messages and emails and found it can be even more convincing than human-created scams. "Our research is just the latest to show how sophisticated the current state of AI is," said Jerson Francia, a BYU cybersecurity Ph.D. student and co-author of several papers on the topic. The research, led by BYU cybersecurity professor Derek Hansen, found participants struggled to determine whether a message was written by AI or a person, correctly identifying the source only 52% of the time.
AI matched or outperformed humans in generating a click in 80% of cases. In other words, you may no longer be able to recognize AI-generated phishing simply by how a message is written. Text messages and emails that reference personal details such as participants' jobs, hobbies, workplaces or social media activity can be harder to distinguish from legitimate messages.
As more details about people's lives become readily available online, AI can quickly gather that information and use it to create messages that appear trustworthy. Messages that included job-related personal details were the most convincing. References to a person's workplace or occupation made the messages feel more relevant and credible, showing how even basic professional information can be used to make a scam more persuasive.
"This study opened my eyes to just how good AI is at creating messages that use personal information about individuals," Hansen said. "AI can reduce the time and effort required to create personalized spear-phishing messages, thus making them more effective and more common." AI can amplify the persuasive power of personalization by combining publicly available details to produce a compelling message in seconds. Without AI, scammers would have to manually search for information about their targets and compile those details into a convincing message, making the process more time-consuming and difficult to carry out at scale.
Extract — continue reading at the source.
