Researchers at Brigham Young University, led by cybersecurity professor Derek Hansen with PhD student Jerson Francia, ran an experiment that started around three years ago when ChatGPT first appeared. Participants supplied some personal information about themselves. Cybersecurity students trained in AI then sent them messages designed as scams, some written by humans, some generated with GPT-4. Recipients ranked how convincing the messages were and decided whether to click.
Three numbers came out of it.
People correctly identified whether a message was written by a person or a machine 52 percent of the time. That is a coin flip.
AI-generated messages fooled people 28 percent of the time, against 21 percent for human-authored ones.
In 80 percent of cases, AI matched or outperformed humans at generating a click.
And one more, which is the one worth acting on: messages mentioning a coworker are 2.3 times more likely to be clicked than messages from a generic organisation.
Spear phishing uses personal details, a job, a colleague, a hobby, a social media post, sometimes a voice, to make a message specific enough to be believed. Around 90 percent of corporate hacks begin this way. The raw material required is basic: company websites, LinkedIn profiles, social media accounts and organisational directories are enough.
What has changed is not the technique. It is the arithmetic of effort.
A human attacker researching a target has to read, compile and write, which limits them to a handful of people. An agent aggregates public information and synthesises a plausible message at whatever volume you ask for. So the personalised attack, which was always the effective one, stops being expensive.
The BYU release puts the practical consequence bluntly: you may no longer be able to recognise AI-generated phishing simply by how a message is written. Every heuristic people were taught, odd phrasing, stilted grammar, generic greetings, was a proxy for a person who did not know you and was not fluent. Both of those gaps have closed.
The coworker finding is the part any small business should sit with, because it explains why the training everybody does is aimed at the wrong thing. Staff are taught to be suspicious of strangers. The data says the danger is a message that appears to come from inside the room, and the information needed to fake that is on your own website, on the About Us page listing everyone by name and role.
None of that means taking the page down. It means the defence has to move from recognition to procedure. Nobody can reliably spot these any more, so the control cannot be individual judgement. It has to be a rule: unexpected requests for passwords, ID numbers, financial details or security codes get verified on a different channel, always, regardless of who appears to be asking.
The researchers also suggest running links through scam-checking services such as VirusTotal, URLVoid or ScanURL, and reporting suspicious messages to your workplace or organisation.
Fifty-two percent. You are guessing, and so is everybody else.
Source: KSL, “AI is making spear phishing scams more successful, BYU research finds”
