@Steve-Wilme wrote:
The quality of the English is only one of a number of indicators that an email is phishy. It's important to look for the other signs, such as, Are you a named addressee? Does it prompt to act with urgency? Does it attempt to mimic someone senior in your organisation? Does it sound too good to be true?
Back when WiFi became a thing (I know, dating myself), and people were freaking out about its impact on network security, I remember someone noting that if WiFi had you worried, you were probably living with a false sense of security. A lot of the talk about ChatGPT strikes me the same way: If you see it as some watershed threat, you've probably been more vulnerable than you realize. If misspellings are what your employees look for to tip them off to phishing, yikes! Have you seen what passes for "professional" communications these days?
I welcome the flaming on this statement, but defeating phishing can be solved, not by going forward, but by going back: Stop using HTML email! It doesn't do what most people think it does, but it certainly obfuscates links and creates the distraction that allows such scams to succeed. Now, I'll grant that in limited, intranet-level type communications, it may be OK to use. Regardless, ChatGPT advantage to the bad guys is that it is a longer lever for exerting leverage but not that it is a new category of threat. If AI/ChatGPT is the big bad wolf, then maybe it's finally time to tell grandma to get new glasses, lock her door, and stop letting strangers in the house - things she should have been doing years ago.
