AI can make phishing messages more polished and easier to produce at scale, so spelling errors are no longer a dependable warning sign. The strongest response is to change settings and habits that limit what an attacker can do after a convincing message: use multifactor authentication (MFA), choose phishing-resistant sign-in methods where available, protect email domains from spoofing, and make suspicious messages easy to report.
Why AI changes the phishing warning signs
A well-written message can still be fraudulent, and an awkwardly written one can still be legitimate. Treat unexpected requests to sign in, share sensitive information, approve a payment, or install software as unverified until you confirm them through a separate, trusted route.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s Digital Defense Report 2025 says AI-automated phishing emails in its reported study achieved a 54% click-through rate, compared with 12% for standard attempts, which the report describes as a 4.5-times increase. Those are Microsoft’s study results, not a universal click rate or an industry-wide estimate.
Free tools Windows power users keep installed
One-click scans. No signup required.
Phishing can also be part of a broader distraction. Microsoft reports that inbox flooding may bury security notifications and be followed by fake IT-support calls or requests to install remote-access software. Protecting sign-in alone is not enough; people need a clear way to report suspicious activity and organizations need a process to respond.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which account settings should individuals change first?
Start with accounts that can expose sensitive information or unlock other accounts. Turn on MFA for primary email first, then financial accounts, cloud storage, social accounts, and any service used to reset passwords. If an account offers several methods, choose the strongest one it supports.
Use a passkey or security key where supported
Prefer a FIDO2/WebAuthn security key or a supported passkey option when the service and your devices allow it. NIST’s Special Publication 800-63B explains that WebAuthn/FIDO2 can provide phishing resistance through verifier-name binding: the authenticator uses the legitimate service’s domain when responding. That helps prevent a fake sign-in page from collecting a reusable authentication response.
A physical security key is one option; passkey availability and behavior vary by provider, operating system, and device. Check the account’s own security settings and recovery instructions before switching, and consider a second supported authenticator or other recovery method so a lost device does not lock you out.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use other MFA if phishing-resistant options are unavailable
CISA advises that any MFA is better than none. If a service does not offer passkeys or security keys, enable the strongest available alternative. An authenticator-app code is a useful fallback, but a code that you manually type into a website is not phishing-resistant under NIST’s definition: a fake site may relay it to the real service while it is still valid.
Never approve a sign-in prompt you did not initiate. If prompts arrive unexpectedly, deny them and use the service’s official app or address to review account activity and change credentials if needed.
Protect passwords and recovery routes
- Use a unique password for every important account; a password manager can generate and store them.
- Save recovery codes in a secure place separate from the account they unlock.
- Set up a second recovery method before you lose access to your primary method.
- Review recovery email addresses, phone numbers, trusted devices, and active sessions periodically; remove anything you do not recognize.
MFA reduces the risk that a stolen password alone is enough to enter an account, but password reuse can still expose several services if one credential is compromised.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Limit details that make impersonation easier
Review social-media privacy settings and reduce publicly visible personal details where practical. Names of colleagues, family relationships, travel plans, job responsibilities, and payment routines can help a scammer make a request sound familiar. Privacy settings cannot prevent all impersonation, but they can reduce information available to an attacker.
How do organizations reduce risk across email and work accounts?
Workplace controls address different stages of an attack and should be layered. MFA helps resist account takeover; SPF, DKIM, and DMARC help receiving systems evaluate whether messages claiming to come from an organization’s domain are authorized; endpoint detection can help identify harmful activity on devices; and reporting plus verification gives people a way to interrupt the attack.
Require MFA and move toward phishing-resistant sign-in
Require MFA for email, file sharing, remote access, privileged accounts, and users who handle sensitive information. Prioritize administrators and high-impact accounts, then roll out phishing-resistant methods such as FIDO2/WebAuthn in stages. Test enrollment, device replacement, emergency access, and recovery before making the stronger method mandatory.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For an account that supports multiple methods, prefer a phishing-resistant authenticator. If that is not immediately possible, enforce the strongest available MFA and plan a migration rather than treating all MFA methods as equivalent. CISA’s MFA guidance for businesses recommends requiring multifactor authentication.
Configure SPF, DKIM, and DMARC for owned domains
Set up SPF, DKIM, and DMARC for the organization’s sending domains, and monitor authentication results and policy outcomes. These controls help reduce direct spoofing of a domain the organization owns. They do not stop every phishing message: attackers can use lookalike domains or send from a legitimate account they have compromised. CISA discusses domain protections and other AI-related risks in its guidance on generative AI and election risks.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMake reporting and verification routine
Give employees a simple, well-known way to report suspicious email, such as a reporting button or a dedicated address, and ensure someone reviews those reports. Teach staff to verify unusual payment instructions, requests for credentials, or sensitive-data requests using a known phone number or another established channel—not contact details or links included in the message itself.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Practice should focus on actions, not on spotting bad grammar. A convincing message may be fraudulent; reporting uncertainty is preferable to clicking or replying to resolve it.
Prepare endpoints and accounts for response
Deploy and tune endpoint detection and response tools, and define who can act when an account or device may be compromised. The response process should support revoking active sessions, resetting credentials, checking mailbox forwarding rules, and reviewing newly added authentication methods. Monitor or restrict external collaboration and remote-access tools where appropriate, particularly when unexpected support requests follow a burst of messages.
Quick Recap
How the main controls fit together
| Control | What it helps address | What it does not do by itself |
|---|---|---|
| MFA, especially FIDO2/WebAuthn | Reduces the chance that a stolen password or a fake sign-in page can be used to take over an account. | Does not replace account recovery safeguards, session monitoring, or response to a compromised device. |
| SPF, DKIM, and DMARC | Help protect an organization’s owned email domain against direct spoofing. | Do not block lookalike domains or mail sent from a compromised legitimate account. |
| Endpoint detection and response | Helps identify suspicious activity on managed devices. | Does not prevent every fraudulent message from reaching an inbox. |
| Reporting and independent verification | Creates a route to investigate suspicious messages and confirm high-impact requests before acting. | Depends on a usable reporting process and verification through a trusted, separate channel. |
What to do when a message or sign-in seems suspicious
- Do not use the message’s link or contact details. Open the service through its official app or a saved address, or contact the requester using a number or channel you already trust.
- Report the message. Use your organization’s reporting channel, or the service’s abuse or phishing-reporting option for a personal account.
- If you entered a password, act from a trusted device. Change it through the official service, change it anywhere else it was reused, and revoke unfamiliar sessions. Review recovery details and sign-in methods.
- If you approved a prompt or shared a code, contact the service or security team promptly. Ask them to secure the account and review recent activity; do not assume that changing the password alone ends an active session.
- If you installed remote-access software or opened a suspicious file, stop using the affected device for sensitive sign-ins and contact your organization’s IT or security team. Follow its incident process rather than trying to investigate or remove evidence on your own.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
