Field guide / phishing response
Why polished writing and authentication cannot prove an email is safe
AI changes presentation. It does not replace independent verification.
Look at the requested action
A well-written message can still ask you to send money, disclose a code or install software. Poor grammar can appear in legitimate messages too. Ask whether the action was expected and how to verify it through an independent channel. Do not paste confidential correspondence into an unapproved public AI service merely to obtain a reassuring verdict.
Understand authentication boundaries
SPF, DKIM and DMARC help establish sender-domain authentication and handling policy. They do not establish whether a payment is authorised or an attachment is harmless. A compromised legitimate account may send authenticated mail. A lookalike domain can configure its own authentication. A green result is not permission to ignore the substance of a request.
Use an assistant for explanation, not certainty
An AI assistant may organise a redacted incident note or explain an unfamiliar term. It can also misread a domain or invent confidence. Instructions inside an untrusted message remain untrusted even when quoted by an assistant. Keep payments, credential entry and recovery on independently verified services.
Worked example: authenticated fraud
An email from a real supplier account passes authentication checks and requests a confidential bank-detail change. The instruction may still be unauthorised. Finance uses its known-contact verification process instead of treating authentication as a safety guarantee. The business question is who authorised the destination, not merely which domain sent the mail.
Build usable layers
Have an administrator configure and monitor email authentication without disrupting legitimate senders. Pair that with strong account protection, a clear reporting channel and a tested payment-change process. Ask your provider how to review sessions and suspicious forwarding rules. Practical recovery controls matter more than a single badge, score or AI verdict.
Sources and scope
Source guidance informs the actions above. Explanations and worked scenarios are original. Provider controls and reporting routes vary; follow your provider and employer’s instructions.