Why Phishing Still Works (Even With Advanced AI)
The short answer: scammers are not failing to write good emails. Many are deliberately writing bad ones, because the economics reward it.
"Can someone explain how we have such advanced AI and we still have so many obvious phishing and bot sales emails?"
1. Run the scam economics yourself
Sending email is nearly free. That means even absurdly low reply rates are profitable. Drag the sliders and watch the profit line. Notice how hard it is to make spam unprofitable.
2. Obvious mistakes are a filter, not a flaw
A famous Microsoft Research finding: scammers who follow up with victims pay a real human cost per conversation. A crude, typo-filled email scares off skeptical people early, so only the most credulous reply. The mistakes pre-qualify the victims.
Slide toward polished and replies rise, but most are skeptics who waste the scammer's time and never pay. Slide toward crude and nearly every reply is a likely victim. Advanced AI does not remove this trade-off; for mass scams, crude often still wins.
3. Five more reasons the junk keeps coming
- Survivorship in your inbox. You mostly see the phish that beat the filters. Billions of better-crafted ones were already blocked, so the visible sample skews weird.
- AI raised both sides. The same models that could write perfect scams also power spam filters. The cheap-and-obvious tier slips through in volume precisely because it is low effort to regenerate endlessly.
- Legal and platform friction. Major AI providers block scam generation, so many low-skill operators still use templates from 2009. The barrier is not capability, it is access and operational laziness.
- Targeting is expensive; volume is free. Well-crafted AI spear phishing exists and it is genuinely dangerous, but it is aimed at executives and finance teams, not at you in bulk.
- It only has to work once. At near-zero cost, a 0.001% success rate on ten million emails is still a hundred victims. Bad emails persist because they never stopped paying.
4. Spot the phish: your inbox, simulated
Three messages. Mark each one Phish or Legit, then read why. Some real emails look scammier than actual scams, which is part of the problem.