Home · Personal · Tech & Digital Life · Troubleshooting

PARTLY

As of 13 August 2026, AI can only partly tell if an email is phishing.

This still needs a person who signs their name to it.

Can you do it?

5 minutesto a draft.

30 minutesto something you’d act on.

Cost, all in£0

Skill neededchat-fluent

Who has to check ityou

What the alternative costsThe supplied tool data contains no comparable price for a phishing-detection service.

If this goes wrong, you may click a malicious link, disclose credentials or send money before discovering that the classification was wrong.

What to actually do

  1. Hand it to a person

    The route this page recommends

    A person who owns the outcome does this end to end, worth it when the failure is dear.

  2. Use a tool built for this

    Second choice

  3. Do it yourself

    The distant third

    A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

    How to actually do it

    1. Open the suspicious email without clicking its links, downloading attachments or replying, and copy the message text into a plain note.
    2. Copy the visible sender address, reply-to address, subject, link text, destination shown by your mail app and attachment names, but do not open the links or files.
    3. Remove passwords, one-time codes, payment details and unnecessary personal information, then paste the remaining content into the prompt.
    4. Ask the chatbot to assess the message and list observations, unknowns, confidence and safe verification steps.
    5. Open the organisation's website by typing its address yourself or using a trusted bookmark, and compare its contact details, notices and sign-in route with the email.
    6. If money, account access or personal data is involved, contact the organisation through a known route and ask whether it sent the message before taking action.
    7. Report the message using your email provider's phishing option, then delete it or leave it quarantined according to your provider's instructions.

    Prompt

    Assess whether this email is likely to be phishing. Treat the result as a cautious triage assessment, not proof. Do not tell me to click a link, open an attachment, reply, call a number in the email or sign in through the message. Examine the wording, urgency, requests for money or credentials, sender address, reply-to address, claimed organisation, link text and destination, attachment names, and any authentication results I provide. Separate observations from inferences, identify what cannot be checked from the supplied information, and give a confidence level of low, medium or high. End with safe next steps: how to verify the message through the organisation's official website or a known contact route, and how to report or delete it. If the message may be genuine, say how to verify it without using the email's links or contact details. Redact passwords, security codes, payment details and unnecessary personal information before analysing this material.

Email content:
[PASTE EMAIL CONTENT HERE]

Sender, reply-to and technical headers:
[PASTE AVAILABLE DETAILS HERE]

Visible links and attachment names, without opening them:
[PASTE DETAILS HERE]

    Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.

What it gets wrong

  • AI cannot see live domain reputation, malware telemetry or current sender authentication unless you provide reliable results from a security tool.
  • AI cannot safely open an attachment or follow a link to test what it does.
  • AI cannot prove that a message is genuine from writing style or branding because those features can be copied.
  • The consequences of clicking, paying or disclosing information remain yours, not the model's.

What caps this at PARTLY: real time truth, verification cost and stakes of error.

How we scored this

Five axes, each scored nought to two by hand: ten means AI carries the task cleanly, and the thresholds that turn a total into YES, PARTLY or NO are published in the methodology. Each axis name links to its definition.

AxisScore (0–2)
Output2
Inputs1
Verification1
Liability1
Effort delta2
Total7 / 10

The methodology and its thresholds are published in full.

FAQ

Can ChatGPT check if an email is phishing?
Yes, it can perform an initial assessment if you provide the email text, sender details and visible link information. Treat its answer as triage because it cannot reliably check live technical evidence or accept responsibility for a wrong call.
Should I paste a suspicious email into AI?
You can paste a redacted copy for an initial assessment. Remove passwords, one-time codes, payment details and unnecessary personal information, and never paste an active secret.
Can AI tell if an email link is safe?
AI can compare the displayed link with the destination and point out suspicious domains or mismatches if you provide those details. It cannot guarantee that a destination is safe, so verify through the organisation's official website rather than opening the email link.
What should I do if AI says an email is phishing?
Do not click, reply, download an attachment or use the contact details in the message. Verify the claim through a website or phone number you already trust, then report the message using your email provider's phishing option.

Nearby answers

All Troubleshooting rulings

Assessed by gpt-5.6-luna (gpt-5.6-luna) on 2026-08-13, second-checked by an independent model. Wrong somewhere? Email [email protected] and it gets re-checked.

The newsletter

AI news, new answers and product picks, straight to your inbox.