The old advice on phishing was easy: watch for bad spelling, weird addresses, and obvious urgency. That advice is now dangerously out of date. Phishing got smart — convincing enough to fool security professionals — and understanding how it evolved is the difference between confidence and a false sense of safety.
The clumsy era is over
The telltale signs people were taught to spot — broken English, laughable logos, generic greetings — were features of low-effort, mass phishing. They still exist, but the attacks that actually cause damage today look nothing like them. Modern phishing pages are pixel-perfect copies of real login screens, emails are well-written and properly branded, and the whole thing is designed to pass exactly the smell test you were trained to apply.
Targeted and researched
The biggest shift is from spray-and-pray to targeted. Attackers research a specific person — their role, their colleagues, their projects, often from public sources — and craft a message tailored to them. An email that references your actual manager, a real project, and a plausible request is enormously more convincing than a generic plea. When the lure fits your real context, the usual skepticism does not fire, because nothing seems out of place.
AI made it scale
What used to take effort now scales. Language tools let attackers write fluent, personalized messages in any language, at volume, removing the grammatical tells that gave older phishing away. The result is mass-produced phishing with the polish that once required a skilled human per target. The economics flipped: convincing, customized lures are now cheap to generate, so there are more of them and they are harder to spot.
Beating the second factor
The scariest development is that modern phishing defeats some two-factor authentication. An attacker sets up a page that sits between you and the real site, relaying everything in real time — it captures your password and your one-time code and passes them straight to the genuine service, logging the attacker in. Another tactic, "MFA fatigue," spams you with login approval prompts until you tap "approve" just to make them stop. The second factor you trusted is not the backstop you assumed.
Why experts fall for it too
It is comforting to think only careless people get phished. They do not. When an attack is well-researched, well-timed, and technically polished, anyone can be caught in a distracted moment — and the people who handle the most sensitive access are the most valuable, most targeted marks. Phishing now exploits context and timing, not just inattention, which is exactly why expertise is not immunity.
What actually helps
Since you cannot reliably spot the best phishing by eye anymore, the durable defenses are technical. Phishing-resistant authentication — passkeys and hardware security keys — is the strongest answer, because it refuses to authenticate on a fake site no matter how convincing it looks. Slowing down on any unexpected request, verifying through a separate channel, and treating urgency itself as a red flag all help. The mindset shift is to stop relying on catching the fake and start using methods that do not care whether you do.
Analysis by GenZTech.