After AI Fixed the Typos: What Awareness Training Should Teach

A slide that appears in countless awareness decks lists the signs of a suspicious email: spelling mistakes, awkward grammar, a strange greeting. For years it was serviceable advice, because a lot of fraud was written in a hurry or translated badly. The FBI’s Internet Crime Complaint Center said in a December 3, 2024 public service announcement that this is changing in a specific way.

Generative AI can “correct for human errors that might otherwise serve as warning signs of fraud,” the alert says. The training question is no longer how to make staff better at spotting flaws. It is what to teach once the flaws are gone.

What the FBI actually says

The IC3 alert I-120324-PSA, “Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud,” says criminals use AI-generated text to appear believable in social engineering, spear phishing and financial fraud schemes. It notes that AI translation tools reduce the grammar and spelling mistakes that foreign actors targeting U.S. victims might otherwise make, and that AI lets criminals send messages faster to reach more people. Its advice does not mention spotting better flaws. It recommends agreeing on a secret word with family members, not sending money, gift cards or cryptocurrency to people you do not know, and verifying callers by hanging up and contacting the organization directly.

That advice is worth noticing for its shape: every item is a route, not a cue. A secret word is a prior arrangement. Hanging up and calling back is a different channel. Not sending assets to strangers is a rule about the request. None depends on inspecting the message.

Why cues are a fragile foundation

A cue is a property of an artifact: a wrong domain, a tone, a typo. Attackers can fix an artifact. A route is a property of how you respond: where you go to check, who you ask, what you do not do. Attackers cannot fix that without access to something else.

Evidence on training suggests cue-spotting was thin even before AI. A 2024 study in the Journal of Universal Computer Science, “Recognition of genuine and phishing emails may not be associated with response to phishing attacks” by Crgol and Vrhovec, combined a survey of 135 Slovenian university students with a field trial. They found no significant associations between recognizing either phishing or genuine emails and how people responded to a real attack. The authors read this as a challenge to assumptions behind current training. It is a single small student study, so it is a signal to test locally, not a rule.

A second line of evidence: what happens after a click

A March 2026 preprint on arXiv, “Breaking Bad Email Habits” by Hydari, Adjerid, Lu and Ramasubbu, analyzed logs from 17 simulated phishing campaigns delivered to university staff and faculty: 192,840 person-by-campaign observations from 19,341 employees. Because it is a preprint, it has not completed peer review. The authors argue that most observed repeat clicking reflects stable differences between people rather than the effect of a recent failure, and that persistence is stronger when successive campaigns share similar persuasion cues. Two findings bear directly on training design:

• Teachable-moment pages that used emotion or heuristic framing and an explicit reporting pitch could largely eliminate the persistence.
• Pages that annotated the email with cues modestly worsened it, and employees who engaged with the education page showed greater persistence than those who dismissed it, which the authors read as consistent with an emboldening effect in consequence-free training.

We read the abstract and introduction, not the full model. Even so, the direction is useful: the training element that worked best gave people a concrete action to take (report), while annotating the email with cues modestly made persistence worse.

Rebuilding a module around routes

Here is what a change might look like. This table is our design proposal, not a tested curriculum.

The “flawless message” row is the key change. If the training example is a clean message, no learner can succeed by noticing a flaw, so the module has to teach the next thing.

Three routes worth teaching

1. Switch channel to one you already hold. A number from an invoice, a bookmark, a directory. Our piece on what happens when a conversation changes channel covers why the new channel must be the one you choose.
2. Name the owner. For any request involving money, access or data, who in the organization can authorize it? If the requester is not that person, the request goes to them.
3. Report without waiting to be sure. The Hydari et al. finding about a reporting pitch matches an operational fact: a report costs a minute, and silence costs the defenders an early signal. Make reporting one click and safe, as in the first response to a report.

What not to throw away

None of this means cues are useless. A mismatched domain still catches things, and a message that asks for a code or a gift card is still the wrong shape regardless of polish. The argument is about weight. A module that spends most of its time on cues spends it on the part attackers can edit.

Nor does the evidence say training is ineffective. The sources we have are narrow: one small recognition study, one preprint about simulation logs from a single institution. They do suggest that what is taught and how the teachable moment is framed matter more than how often the test is run. For a broader reading of the evidence base, see a 54-study phishing review as a reason to ask better questions. And for the moment of saying no under social pressure, why knowing the warning signs is easier than saying no is the companion piece; this one is about the design of the training that comes before it.

How to measure a rebuild

Track what the route-based module is meant to change: how often requests are verified through the correct channel, how quickly suspicious messages are reported, and whether the exception queue grows. Keep the old click measure, but do not let it be the headline, since a lower click rate can tell the wrong story.

A 45-minute session outline

For teams that want to try a route-based session, here is a draft. It is a sketch to adapt, not a validated curriculum.

1. Ten minutes: the clean message. Show a flawless request. Ask each person to write down what they would do. Collect the answers without comment.
2. Ten minutes: the map. Put up the real routes in your organization: who approves payments, who owns access requests, how to report. Ask where the map has holes.
3. Fifteen minutes: three scenarios. A vendor changing bank details, a colleague asking for a code, a caller claiming to be from IT. For each, the group decides the verification route and who needs to be told.
4. Five minutes: the report. Practice the actual act of reporting, including on a phone. The Hydari et al. result about a reporting pitch is a reason to rehearse the action, not just mention it.
5. Five minutes: the holes. List what the group found missing. Assign each hole an owner. This list is the outcome, and the main reason to run the session.

The measure of success is the length of the hole list falling over a quarter, not a quiz score. A session that finds no holes was probably not realistic enough.

A caution about the evidence

The three sources point the same direction, which is not the same as settling the question. The FBI alert is a statement about criminal capability, not a measurement of how many people are now deceived. The student study is small and the preprint has not been through peer review. We would not build a program on any one of them. We would use them to justify a cheap local trial: change one module from cues to routes, track reporting time and verification rates for a quarter, and keep the change only if your own numbers move.

Sources

• Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (FBI IC3, December 3, 2024): error correction, translation, recommended actions.
• Recognition of genuine and phishing emails may not be associated with response to phishing attacks (Crgol and Vrhovec, Journal of Universal Computer Science 30(9), 2024).
• Breaking Bad Email Habits: Bounding the Impact of Simulated Phishing Campaigns (Hydari, Adjerid, Lu, Ramasubbu; arXiv:2603.04324, March 2026; preprint).