The Scam That Knows Your Coworker's Name
BYU researchers found people can't reliably tell AI-written phishing from the human kind, and that the most persuasive detail was a coworker's name. Here is where those details come from, why they work, and the one check they can't touch.
For years, the scam that knew your name was the expensive one. Somebody had to read up on you, work out who you work for and who you work with, and write something that sounded like it came from inside the building. Most scammers couldn't be bothered, so most of us got "Dear Valued Customer."
Researchers at Brigham Young University just measured what happens now that the expensive version is cheap.
What BYU found
The team, led by cybersecurity professor Derek Hansen with PhD student Jerson Francia, showed working adults a mix of phishing emails and text messages. Some were written by people. Some were written by AI. Participants were asked what they would do with each one.
Three numbers stand out:
- 52%. That's how often people correctly guessed whether a person or an AI wrote the message. A coin flip gets 50%.
- 28% vs 21%. AI-written messages fooled people 28% of the time. Human-written ones managed 21%. In 80% of cases, the AI did as well as the human or better.
- 2.3 times. A message that mentioned a coworker was 2.3 times more likely to get the click than one from a generic organization.
That last number is the one to keep. What moved people wasn't better grammar or a cleaner logo. It was a detail that made the message feel like it came from someone they know.
"AI can reduce the time and effort required to create personalized spear-phishing messages," Hansen said, "thus making them more effective and more common."
Where the details come from
Most of it is sitting in public. Your company's website lists who works there. LinkedIn lists your title and who you report to. A staff directory shows everyone's email in the same format. A press release names the project you're on.
None of that is secret. For a person, stitching it together took an evening per target. A model does it in seconds and doesn't get bored on the thousandth one.
Then there's the part that isn't public. The same week BYU's findings made the news, IDScan, a company whose scanners check IDs at entertainment venues, car rental counters, and cannabis dispensaries, confirmed that someone had been inside its systems from April 1 to September 2. It says 13 to 15 million people had their names, dates of birth, and license or passport numbers taken. The hacker claims the real figure is more than 150 million.
Public details make a message sound familiar. Breached details make it sound official.
How it plays out
- Someone picks a company and pulls its staff page and a handful of LinkedIn profiles.
- A model writes a message from a real coworker, about a real project, in the tone that office actually uses.
- If there's breached data to work with, a birthdate or an ID number can show up as "verification."
- The ask is small: open a shared file, confirm your login, look over an invoice.
- The link goes to a page that looks exactly like the thing it's pretending to be.
A fair caveat
BYU ran this as a survey. People knew they were looking at test messages and said what they would do. Nobody was caught in the wild, so real click rates could run higher or lower. We'd still bet on the direction, because it matches what we argued three weeks ago: once the careful scam costs what the lazy one costs, nobody has a reason to send the lazy one.
What still works
- Treat specifics as neutral. A message that knows true things about you has proved one thing: someone looked you up. Your coworker's name is not a password.
- Ask who started it. Good writing doesn't change the shape. Something arrived out of nowhere and wants you to act.
- Use a second channel. Walk over. Call a number you already had. Message the coworker somewhere other than the thread you got.
- Go to the site yourself. Type the address or use a bookmark instead of the link.
- Freeze your credit. You can't easily tell whether your ID went through IDScan. A freeze at the three bureaus is free and takes a few minutes each.
Where SAFE Portal fits
Link screening compares the domain in front of you with the one it's imitating, however well the email was written. The password manager fills based on where a page actually lives, so a flawless copy of your company's sign-in page gets nothing. Password fields and downloads are checked against your own SAFElist and SAFEwall, so a site you've never verified has to be added by you before it gets a credential. On advisor-managed accounts, it doesn't get one at all.
And it's there on the hundredth email the same as the first, including the one that lands when you're tired.
What it won't do
SAFE Portal can't undo the IDScan breach or take your name off a staff page. It also can't help with a message that never sends you anywhere. If an email asks you to reply with a number, or a caller asks you to read back a code, that conversation happens outside the browser, and the defense is still hanging up and calling back.
What it can do is take one question off your plate: whether a link really goes where it claims to. It's at SAFEPortal.to. Free to try, about two minutes to set up.