Join the owners who get Craig's Insider Notes every week.
Updated October 2026 to our current guidance. The original reporting date is unchanged.
Pop quiz, folks. Which of these two emails would you be more worried about: the one with spelling errors and a generic greeting, or the one with perfect grammar that uses your name and mentions a real purchase? Make your pick before you read on.
From: [email protected]
Subject: Your Account Has Been Suspend
Body: “Dear Customer, You account has been limited due to suspicious activity. Click here too verify your identity now or we will close permanent.”
Caught by the spam filter. Obvious typos. Generic greeting. Odd link.
From: [email protected]
Subject: Receipt for Your Recent Purchase
Body: “Hi [Your Actual Name], We processed your payment of $847.95 to TechSupport Pro on March 14, 2026. If you didn’t authorize this purchase, please review your account activity immediately. Transaction ID: PS-847291-2026”
Clean grammar. Your real name. A specific amount. Through the spam filter.
Most people pick Email A, because that is what we were all taught to look for. Typos. Generic greetings. Strange links.
Email B is the one to worry about. It reads like a real receipt, so people click “review your account activity” without a second thought, and the page that opens asks for their PayPal password.
For years, the advice was sound. Scam emails were sloppy, and the sloppiness gave them away. AI took most of those clues off the table.
“Look for spelling mistakes.” AI writes clean English, often cleaner than the real emails in your inbox.
“Generic greetings like ‘Dear Customer’ are suspicious.” AI pulls names, job titles, managers, and projects from LinkedIn, company websites, and old data leaks, and uses them.
“Check that the sender’s domain matches.” Many scam emails now come from real accounts that were broken into, so the sender is genuine and the email passes the technical checks that prove where it came from.
“Look for the padlock.” The padlock means the connection is encrypted. It says nothing about who is on the other end, and most scam sites have one now.
The criminals read the same training your staff did. They write emails that pass every test on the list.
Have a look in your spam folder. There is often a real email from your bank in there, or a password reset you actually asked for. And now and then, a scam email lands in the inbox looking perfect.
Here is how that happens. Real bank emails often come from several different servers, use marketing language like “Act now,” and carry lots of links and tracking images. Filters are trained to distrust all of that.
A scam email sent from a real, broken-into account has none of those quirks. It has one sender, clean authentication, natural language, and a single link. To a filter, it looks like an ordinary business email, so it gets delivered.
Craig started in this field in 1991, when scam emails were stories about a prince with an inheritance. By 2015 they were better written, but a careful person could still spot most of them. Today a careful person often cannot, just by looking, and that includes people who do this for a living.
That is not a failing on your part. What is left to check is mostly out of sight: the email’s headers, whether the sender’s domain really authorized it, how old that domain is, and where the link actually goes. Those take tools to read.
Craig’s father fell for a phishing email. Someone got remote access to his computer and started looking for his financial papers. Craig’s stepmother noticed the cursor moving on its own and called him. He connected, shut them out, and locked the computer down before they found the file with his bank details.
His father has a cybersecurity guy on speed dial, and the email still got through. The habits below are the ones Craig asked him to keep.
An email asking you to update bank details? Call the company on a number from an old bill, not the one in the email. The boss asking for a wire transfer? Call or text them on their cell. A notice from Medicare? Go to Medicare.gov yourself. Real urgency can wait two minutes for a phone call. Fake urgency usually cannot.
However real the email looks, if it wants you to sign in, open your browser, type the address yourself, and sign in that way. If there really is a problem with the account, you will see it there. It takes an extra 30 seconds, and Craig has seen it stop most of these scams outright.
When an email looks perfect but something feels off, trust that feeling, and do not spend an hour on it. Don’t click anything in it. Ask someone you trust to look at it, or check with the sender using a phone number or address you already have.
Craig explains this one with an old spy movie. In the films, the fake passport had tells: the wrong watermark, a typo in the number, a photo that did not quite match. If you knew what to look for, you caught it.
Now picture forgers so good that their passports are cleaner than real ones. That is roughly where email is. Real business email has quirks, because it is built by different teams on different systems over many years. A scam email written by AI and sent from a real account can have none of them. Perfect stopped being a sign of real.
A scam email is one door. The other is the software already on your computer. When someone clicks the wrong link, the attack usually needs an out-of-date program to get any further.
Windows Update never touches third-party software.
It keeps Windows current. It does not update your PDF reader, the file compression tool, or the remote-access program. Each has its own updater, or none. Nobody did anything wrong. That is where Windows Update’s job ends. So who has been checking the rest?
Guess how many programs are installed on the computer you are using right now, and write the number down. Then run the Reveal Scan. It counts what is installed on each Windows PC: how many programs are current and how many need updating. Most people are surprised by both numbers. You don’t have to be able to do this. We’ll do it with you.
Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Every week Craig explains the latest scam emails and how they work, in plain English, with real examples. Sign up for Craig’s Insider Notes at CraigPeterson.com.
Team Craig
Tagged with: