Home · Personal · Tech & Digital Life · Privacy & security
As of 13 August 2026, AI can spot a phishing email.
This still needs a person who signs their name to it.
Can you do it?
5 minutesto a draft.
15 minutesto something you’d act on.
Cost, all in£0
Skill neededchat-fluent
Who has to check ityou
What the alternative costsNo suitable commercial alternative is listed in the supplied tool data.
If this goes wrong, you may click a malicious link, disclose information or send money before discovering that the message was fraudulent.
What to actually do
Hand it to a person
The route this page recommends
A person who owns the outcome does this end to end, worth it when the failure is dear.
Use a tool built for this
Second choiceDo it yourself
The distant thirdA chat interface, chat-fluent skill, and roughly 15 minutes until you can act on the result.
How to actually do it
- Do not click links, open attachments or reply to the email, then copy its full visible text into a new chat.
- Add the displayed sender address, reply-to address, subject line, visible link text and attachment names to the pasted message, without opening anything.
- Paste the supplied prompt after the email and ask the model to assess it using only the information shown.
- Compare each warning sign in the response with the original email and remove any conclusion based on a detail that was not present.
- Open the organisation's website by typing its address yourself or using a bookmark, then check whether the request appears in your account or contact the organisation through a known route.
- If the message remains suspicious or asks for money, passwords or codes, use your email provider's report-phishing control and delete it without interacting with it.
Prompt
Assess this email for signs of phishing, but do not open any links or attachments and do not treat the message as safe just because it looks plausible. Identify the sender address, reply-to address, requested action, urgency or threats, payment or login request, spelling and tone, suspicious domains, mismatched link text and any unusual attachment. Separate observations from conclusions, explain which signs are strong and which are weak, and give me a cautious verdict: likely phishing, suspicious but inconclusive, or no obvious signs. Do not tell me to click, reply, download, sign in or provide personal information. Tell me what I should verify independently using the organisation's official website or a known contact route. Here is the email, including the visible sender and link text: [PASTE EMAIL HERE]
Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.
What it gets wrong
- AI cannot confirm that a sender's account or website has not been compromised.
- AI cannot safely inspect a live link or attachment without exposing you to the thing you are trying to avoid.
- AI cannot know whether a genuine organisation has actually sent a particular request unless you verify it through an independent channel.
- AI cannot take responsibility if you click, pay or disclose information after following its assessment.
- AI can miss a carefully targeted message that contains few obvious warning signs.
Even on a YES, the friction has a name: verification cost, real time truth and stakes of error.
How we scored this
Five axes, each scored nought to two by hand: ten means AI carries the task cleanly, and the thresholds that turn a total into YES, PARTLY or NO are published in the methodology. Each axis name links to its definition.
| Axis | Score (0–2) |
|---|---|
| Output | 2 |
| Inputs | 2 |
| Verification | 1 |
| Liability | 1 |
| Effort delta | 2 |
| Total | 8 / 10 |
The methodology and its thresholds are published in full.
FAQ
- Can ChatGPT tell if an email is phishing?
- It can identify common warning signs in email text, sender details and visible links. It cannot guarantee that an email is safe, so do not click or reply until you have checked the request independently.
- Should I paste a suspicious email into AI?
- You can paste the text and visible sender and link details, but remove passwords, security codes, personal identifiers and anything confidential first. Do not open links or attachments just to give the model more information.
- Can AI check whether an email link is safe?
- AI can point out a mismatch between the displayed link and its visible domain if you provide the text, but it cannot reliably prove that a live destination is safe. Check the organisation by typing its web address yourself or using a known contact route.
- What should I do if AI says an email is phishing?
- Do not click, reply, download or provide information, and use your email provider's report-phishing control. If you already entered a password or sent money, contact the relevant bank or service through its official route and secure the affected account.
Nearby answers
- Can AI help me block scam calls on my mobile?YES
- Can AI check whether my password has appeared in a data breach?PARTLY
- Can AI help me delete my browser cookies?YES
- Can AI help me recover a hacked online account?PARTLY
- Can AI help me secure my home Wi-Fi?YES
- Can AI help me set up two-factor authentication?YES
Assessed by gpt-5.6-luna (gpt-5.6-luna) on 2026-08-13, second-checked by an independent model. Wrong somewhere? Email [email protected] and it gets re-checked.
The newsletter
AI news, new answers and product picks, straight to your inbox.