AI Is Making Scam Emails Look Normal, and Old Warning Signs Are Disappearing

Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts and reused templates now arrive fluent, personalised and unique to each recipient. Proofpoint, speaking at its Protect 2026 conference, argues that the behavioural signals email filters have relied on for years, such as new infrastructure, awkward language, odd timing and requests that do not fit the conversation, are fading as a result.

Proofpoint shared one example involving real estate agents. A single threat actor contacted more than 30 agents at the same company, each from a different account, about a different property and in different words. The opening questions were mundane, such as whether a property was open for inspection or what the price guide was. Every thread ended with the same request: join a video meeting. The sender mailboxes were real, and replies landed in threads the agents were already answering.

US figures point the same way. The FBI's Internet Crime Complaint Center counted more than 22,000 complaints involving AI in 2025, with nearly $900 million in associated losses. It also logged 24,768 business email compromise complaints with about $3.05 billion in reported losses. Proofpoint's view is that detection has to change from asking whether a message looks unusual to asking what it is trying to do.