Updated October 2026 to our current guidance. The original reporting date is unchanged.
Count What’s on Your Computers →See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed.
You were taught to look for typos and strange grammar in phishing emails. Your email has a filter. Your bank has fraud checks. For years that combination worked, and most of the time it still does. What changed this year is the writing. AI tools now write clean, natural emails in any voice, so the typos are gone. They read like the real thing.
Hey folks! The old phishing emails were often written by people working in a second language. They had typos. They asked you to “kindly do the needful” or mentioned “suspicious activity on your account of bank.” You could spot them across the room.
With AI, the scammer types a request along the lines of “Write an email from Wells Fargo about a suspicious transaction, urgent but professional, with a link to verify it.” What comes back reads the way a bank email reads. Same tone, same layout, same polite urgency.
The bigger change is the cost. Writing a convincing email used to take a scammer real time, so most campaigns sent one message to thousands of people and hoped. Now each email can be different, addressed to one person, and mention something true about them. The scammer spends about the same effort either way. In my experience that is why more of these are getting through: there are simply more good ones.
It can also be timed. A scammer can pull what you have posted publicly. You mention a trip to Italy on Facebook, and a week later an email from “your credit card company” asks about charges in Rome. It is timely, it makes sense, and it is fake.
I talked with a retired couple in Concord. The husband got an email from “PayPal” about a $1,200 withdrawal someone in California had supposedly tried to make. Correct logo, clean grammar, an address that looked right at a glance. He clicked the link and signed in on a page that looked exactly like PayPal’s. Within 20 minutes someone was inside his real account, had linked it to his bank, and was trying to move $8,000. His bank froze the transfer.
A business owner in Manchester got an email that appeared to come from one of his vendors. It quoted a real invoice number, used the vendor’s logo, and said their bank had changed. He updated the payment details. The next $12,000 payment went to the scammers. He found out when the real vendor called to ask why they had not been paid.
Neither of these men was careless. Both emails were written well enough to pass the checks they had been taught.
Nobody gave you bad advice. The advice was written for scammers who could not write, and it still catches plenty of them. Here is where each rule now falls short.
Look for typos and bad grammar. AI-written emails rarely have any. The tool was trained on enormous amounts of well-written text, and it shows.
Check the sender’s address. Still worth doing, but a lookalike such as [email protected] is easy to miss on a phone, and some scams come from real accounts that were broken into.
Be wary of urgent requests. Your bank really does email you about odd transactions, so urgency alone does not separate real from fake.
So the useful habits now are the ones that do not depend on reading the email at all.
Most of the time a phishing link is after your password, and the habits above deal with that. Sometimes it is after the computer itself, and that is where old software comes in.
An email filter judges the message. It does not look at the programs on the computer where you open it. When a link or attachment does get through, it lands on that computer, and what it finds there is a separate question.
Windows Update never touches third-party software. It keeps Windows current. Your PDF reader, your browser, the file compression tool, and the rest each update on their own schedule, or not at all. Nobody did anything wrong. That is where Windows Update’s job ends.
So who has been checking the rest?
Before you look, guess how many programs are on your computer and write the number down. Then run the Reveal Scan on your Windows computer. It counts what is installed: how many programs are current and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you want to start on your own, update the programs that open things from the outside world first: the web browser, the PDF reader, and the email program. Then remove anything nobody uses anymore. Deleting an old program is quicker than updating it, and it never needs doing again.
If the second number is bigger than you expected, that is common. You don’t have to be able to do this. We’ll do it with you.
My father fell for a phishing email a few years ago. It was not even an AI-written one. It was an old-style scam, and it still worked.
Someone got remote access to his computer and started going through his files. My step-mother noticed something odd and called me. I connected remotely and shut them out before they reached the spreadsheet with his bank sign-ins.
I have spent 35+ years in cybersecurity. FBI InfraGard trainer. Dozens of managed clients since 1991. None has had ransomware. It still reached my own dad, and it is the reason I built Forward to Safety around people who check the machines, backed by good technology.
The Reveal Scan counts what is installed on each Windows PC: how many programs are current and how many need updating. Read-only, no credit card needed.
Count What’s on Your Computers →The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Want this kind of plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.
Join the owners who get Craig's Insider Notes every week.