Still checking for typos? How UK scam advice is adapting to AI

James Hayes Consulting Research Paper No. 1, October 2026. For twenty years, people in Britain have been taught to spot scams by their mistakes: bad spelling, "Dear Customer", a wonky logo. AI has removed those mistakes. I looked at the public scam advice of 45 UK organisations, including banks, government bodies and regulators, councils, charities, phone networks and delivery firms, to see whether the advice has caught up.

• 60% of the 45 organisations still teach at least one of the old clues, most often spelling and grammar mistakes (53%)
• 7% mention AI on their main scam-advice page; 47% mention it anywhere in the pages examined
• None give specific advice on AI scams, such as cloned voices, on their main page
• 89% do teach the habit that works best: check through a route you already trust

Summary

On 2 October 2026 I examined 146 scam-advice pages from 45 UK organisations: government bodies and regulators, 15 banks and building societies, councils, charities and consumer groups, phone networks, and delivery firms. For each one I recorded whether it still teaches the old "spot the mistake" clues, whether it mentions AI, and whether it teaches the checking habits that still work.

• The old clues are still widely taught. 27 of the 45 organisations (60%) present at least one of them as a sign of a scam. Spelling and grammar mistakes appear in the advice of 24 (53%), and generic greetings such as "Dear Customer" in 18 (40%).
• The advice often contradicts itself. Of the 40 pages that teach an old clue, 32 also say on the same page that scams can look genuine or convincing. 7 organisations say plainly that spelling and grammar are no longer reliable signs, and 5 of those 7 still list them as warning signs elsewhere.
• AI is mentioned, but rarely where people look first. 21 organisations (47%) mention AI somewhere, but only 3 (7%) do so on their main scam page. 16 (36%) give a specific action against AI scams, but none of them does so on its main page. Only 7 (16%) recommend a family code word.
• The good news: the habits that work are widely taught. 89% advise checking through a known, trusted route; 84% advise pausing; 82% say what a bank or the police will never ask; and every organisation names a way to report scams. None suggests that a familiar voice or face proves who someone is.

The fix is mostly a matter of emphasis: lead with checking, retire spelling as a headline sign, and move AI advice to where people actually look. My recommendations are in section 5.

1. Why this matters: the tells have gone

Scam advice has long rested on two kinds of help. The first is spotting the tell: looking for clues that give a scam away, such as spelling mistakes, clumsy grammar, an impersonal greeting or a poor-quality logo. The second is checking by another route: pausing, then contacting the person or organisation through a channel you already trust, whatever the message looks like.

The first kind of help is failing, for three reasons.

• Criminals now write with AI. At least 51% of spam emails were written by AI by April 2025, up from 16% a year earlier, according to researchers who analysed nearly half a million malicious emails.¹ AI writes fluent, correctly spelled English in seconds, in any tone and with your name in it.
• Fake voices and faces are now convincing. Listeners judged AI voice clones to be human 58% of the time, about as often as real voices,² and AI-generated faces have been judged human more often than real ones.³
• The public still relies on the old clues. In Ofcom's 2026 survey, 69% of UK adults said they judge whether a message is genuine partly by "the spelling, grammar or tone of the message". It was the second most common check after "whether you are expecting it" (76%), and ahead of looking at the web address in a link (54%). Among 55 to 64-year-olds it rose to 77%.⁴

The people who fight fraud know this. On 30 September 2026, launching National Trading Standards' AI scam watchlist, Which?'s Rocio Concha said the old "tell-tale signs", such as typos or grammatical errors, "can no longer be relied upon to spot scams".⁵ The question is whether the advice people actually read online has caught up.

2. What I did

Sample. I chose 48 organisations that a person in the UK, and particularly in East Kent, is likely to turn to for scam advice, or to be impersonated by: national government, regulator and campaign sites; the largest banks and building societies, plus the Post Office; national consumer groups and charities; the main mobile and broadband networks; parcel delivery firms and Amazon; and local councils in Kent. A short reserve list was used only where an organisation had no public scam advice at all, or where its site could not be read. The final list is in the appendix.

Pages. For each organisation I examined its main public scam-advice page (the page you'd find by searching for "[organisation] scams advice"); up to three pages linked from it that were specifically about spotting scam emails, texts or calls, impersonation, or AI; and any page about AI scams found by searching the organisation's own website. In total 146 pages were examined, all accessed on 2 October 2026.

Coding. Each page was checked against 12 codes, defined in advance. Every code recorded is backed by a verbatim quote from the page, kept with the data.

Results are reported at two levels: the main page alone, which is what most visitors see, and the whole site, meaning everything examined for that organisation.

How the work was done. Every page was coded against the fixed rules above. Each coded item carries a verbatim quote from the page, and every quote was checked word for word against the page text. Judgement calls are recorded in the data.

3. What I found

3.1 The old clues are still widely taught, but mostly below the front page

27 organisations (60%) present at least one of the old clues as a sign of a scam: spelling or grammar mistakes (24, or 53%), a generic greeting (18, 40%) or poor design and logos (8, 18%). Most of this sits one click down, in guides such as "how to spot a phishing email". Only 7 main pages (16%) mention spelling mistakes. But where the old clues do appear on a main page, they can be prominent: three of the 24 main pages that open with a list of warning signs put spelling mistakes or a generic greeting among the first three.

Some of the advice is emphatic. One building society tells customers to "pay attention to grammar or spelling mistakes as this is a sure sign of a scam".

3.2 Mixed messages

The most common pattern isn't out-of-date advice but contradictory advice. Of the 40 pages that teach an old clue, 32 (80%) also warn, on the same page, that scam messages can look genuine, professional or convincing. Readers are told both to look for mistakes and that there may be none.

7 organisations go further and say outright that the old clues no longer work. One bank's AI scams page is admirably candid: "We used to suggest you look out for spelling mistakes and strange formatting but AI has made them look more convincing." A few lines later, the same page lists "generic greetings like 'dear customer'" as a warning sign. Of the 7 organisations that say the old clues are unreliable, 5 still list spelling mistakes or generic greetings as warning signs on the same page or another. That isn't carelessness. It's what happens when new advice is added to a website without the old advice being taken away.

3.3 AI is mentioned, but rarely where people look first

21 organisations (47%) mention AI, deepfakes or voice cloning somewhere in the pages examined, but only 3 (7%) do so on their main scam-advice page. For 12 of the 21, the only AI page I found came from searching the organisation's website, not from following links on its scam pages. 16 organisations (36%) give a specific action against AI scams, such as agreeing a family safe word or checking a video-call request another way, but none of them does so on its main page. Only 7 (16%) recommend a family code word or safe phrase, the simplest defence against a cloned voice.

3.4 The habits that work are widely taught

This is the good news. 40 organisations (89%) tell people to check by contacting the organisation or person through a route they already trust, such as the number on the back of a card. 38 (84%) advise pausing or name pressure as a warning sign, 37 (82%) say what a bank or the police will never ask you to do, and all 45 name a way to report a scam: 7726, report@phishing.gov.uk, 159 or Report Fraud. No organisation suggested that a familiar voice or a video call is proof of who someone is. The building blocks of good advice are already there. The problem is the order and the emphasis.

3.5 Differences between sectors

Banks are the most up to date on AI: 12 of 15 mention it and 10 give specific advice. But they are also among the most likely to keep the old clues alongside (12 of 15). The delivery firms, whose names are routinely borrowed by scam texts, all still teach the old clues, and none of the 3 mentions AI. Only 1 of 5 Kent councils mention AI. The phone networks, which carry most scam calls and texts, mention it in 1 case out of 5.

4. What good advice looks like

Several organisations already publish advice that fits the AI era. A few examples, quoted from their websites on 2 October 2026:

• Age UK's guide to AI scams is the clearest in the sample: "The old giveaways, like spelling mistakes and clumsy wording, have mostly gone." It warns that "seeing someone on video no longer proves they're real" and recommends agreeing a safe phrase with close family.
• Friends Against Scams (National Trading Standards) says plainly that "a familiar voice is no longer proof of who is calling", and recommends a family code word.
• The National Cyber Security Centre explains why the old advice is fading: "It used to be easier to spot scams. They might contain bad spelling or grammar..."
• Stop! Think Fraud, the government's campaign, explains AI voice cloning in plain English and recommends a safe phrase with close friends and family.

Put together, good advice for the AI era fits on a postcard:

5. Recommendations

For organisations that publish scam advice:

1. Lead with checking, not spotting. Put "stop, and check by another route you already trust" at the top of every scam-advice page, ahead of any list of warning signs.
2. Retire spelling and grammar as a headline sign, or keep it only with a clear caveat that well-written messages can still be scams. The same goes for generic greetings and poor logos.
3. Say plainly that voices, faces and videos can be faked, and that a familiar voice or a video call is not proof of who someone is.
4. Recommend a family safe word, as the FBI, Police Scotland and the UK government's Stop! Think Fraud campaign already do.⁶⁷
5. Put the AI advice where people will see it. Guidance on deepfakes that lives several clicks deep, or only in a news story, won't reach most people.
6. Date your pages and review them at least once a year. Scam methods change faster than web pages.

For everyone else, the habits are simple: stop, check by a different route, and never move money or share a code because of a message, call or video alone. My guide to how criminals use AI goes through the tactics one by one.

6. Limitations

• A snapshot. Websites change; this shows the advice as it stood on 2 October 2026.
• A purposive sample. These are prominent organisations, not a random sample of all UK scam advice, so the percentages describe this group of 45, not the whole internet.
• Some sites couldn't be read. Six of the 48 organisations originally chosen couldn't be read on the day, because their websites blocked automated access: Action Fraud (now Report Fraud), the Metropolitan Police, Kent Police, TV Licensing, Revolut and Royal Mail. Three were replaced from the reserve list (Dover District Council, Halifax and DPD) and three were not, leaving 45. Two other reserves, Swale Borough Council and NHS England, had no scam-advice page. The search for AI pages also had to use different methods for different organisations: a web search for some, the site's own index of pages for others. It may therefore have missed some AI pages, so the AI figures are best read as minimums.
• Pages, not people. The audit measures what advice says, not what people read or remember, or whether the advice works.
• "Old clues" aren't worthless. Plenty of low-effort scams still contain mistakes, and a misspelt web address remains a useful warning sign. The concern is when old clues are presented as reliable, without a caveat, and ahead of checking habits.
• Judgement calls. The coding followed fixed rules, with a verbatim quote for every code, but some judgement calls could reasonably go the other way, and they are noted in the data, which I'm happy to share.

Appendix: organisations and coding

The 45 organisations examined, with the main scam-advice page used for each. The full data, including every page examined and a verbatim quote for each code, is available on request.

Banks and building societies

• Barclays: www.barclays.co.uk/fraud-and-scams/
• Lloyds Bank: www.lloydsbank.com/help-guidance/protecting-yourself-from-fraud.html
• NatWest: www.natwest.com/fraud-and-security.html
• HSBC UK: www.hsbc.co.uk/help/security-centre/
• Santander UK: www.santander.co.uk/personal/support/fraud-and-security
• Nationwide Building Society: www.nationwide.co.uk/help/fraud-and-security
• TSB: www.tsb.co.uk/fraud-prevention-centre.html
• Monzo: monzo.com/fraud
• Starling Bank: www.starlingbank.com/mobile-banking-security/fraud/
• Virgin Money: uk.virginmoney.com/fraud-and-security/
• Metro Bank: www.metrobankonline.co.uk/ways-to-bank/i-want-some-information-about/fraud-and-s
• The Co-operative Bank: www.co-operativebank.co.uk/help-and-support/fraud-and-security/
• Chase UK: www.chase.co.uk/gb/en/fraud-and-security/
• Halifax: www.halifax.co.uk/helpcentre/protecting-yourself-from-fraud.html
• Coventry Building Society: www.coventrybuildingsociety.co.uk/member/help/member-support/security.html

Government, regulators and campaigns

• National Cyber Security Centre (NCSC): www.ncsc.gov.uk/collection/phishing-scams
• Stop! Think Fraud: stopthinkfraud.campaign.gov.uk/
• FCA ScamSmart: www.fca.org.uk/consumers/protect-yourself-scams
• HMRC: www.gov.uk/government/collections/hmrc-phishing-and-scams-detailed-information
• Take Five to Stop Fraud: www.takefive-stopfraud.org.uk/
• Ofcom: www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/scam-calls-texts-a
• Friends Against Scams (National Trading Standards): www.friendsagainstscams.org.uk/scam-protection-steps-you-can-take

Charities and consumer groups

• Citizens Advice: www.citizensadvice.org.uk/consumer/scams/check-if-something-might-be-a-scam/
• Which?: www.which.co.uk/consumer-rights/advice/how-to-spot-a-scam-alFiz5h8mnJ9
• Age UK: www.ageuk.org.uk/information-advice/money-legal/scams-fraud/
• Victim Support: www.victimsupport.org.uk/crime-info/types-crime/fraud/
• Independent Age: www.independentage.org/get-advice/money/scams
• Get Safe Online: www.getsafeonline.org/personal/articles/spam-and-scam-email/
• MoneyHelper: www.moneyhelper.org.uk/en/money-troubles/scams
• Stop Scams UK: stopscamsuk.org.uk/campaign/get-help-now/

Phone and broadband networks

• BT: www.bt.com/help/security/scams
• EE: ee.co.uk/help/security/staying-safe-online/avoid-and-prevent-scams
• Vodafone UK: www.vodafone.co.uk/privacy/protecting-you
• Virgin Media O2: www.o2.co.uk/help/safety-and-security/fraud-scams-and-unwanted-calls/scam-calls-
• Three UK: www.three.co.uk/privacy-safety/fraud-to-watch-out-for

Local councils (Kent)

• Kent County Council: www.kent.gov.uk/leisure-and-community/community-safety/consumer-protection/commo
• Medway Council: www.medway.gov.uk/info/200138/your_council/389/fraud
• Canterbury City Council: news.canterbury.gov.uk/news/sly-scammers-target-council-taxpayers/
• Thanet District Council: www.thanet.gov.uk/info-pages/safety-links/
• Dover District Council: www.dover.gov.uk/council-tax/council-tax-scams

Delivery firms and Amazon

• DPD UK: www.dpd.co.uk/content/about_dpd/phishing.jsp
• Evri: www.evri.com/cyber-security
• Amazon UK: www.amazon.co.uk/gp/help/customer/display.html?nodeId=G4YFYCCNUSENA23B

DVLA and Post Office

• DVLA: www.gov.uk/government/news/dvlas-top-tips-for-avoiding-scams
• Post Office: www.postoffice.co.uk/fraud-protection

Research Paper No. 1, James Hayes Consulting, October 2026. The full dataset, with the pages examined and a verbatim quote for every code, is available on request: enquiries@jameshayesconsulting.com. Please cite as: Hayes, R. (2026), "Still checking for typos? How UK scam advice is adapting to AI", James Hayes Consulting.

Sources

1. Hao, Tran, Rideout et al., "Do Spammers Dream of Electric Sheep?", ACM Internet Measurement Conference 2025. Data from Barracuda, which employs several of the authors.
2. Lavan, Irvine, Rosi and McGettigan, "Voice clones sound realistic but not (yet) hyperrealistic", PLOS One, 2025.
3. Miller et al., "AI Hyperrealism: Why AI Faces Are Perceived as More Real Than Human Ones", Psychological Science, 2023.
4. Ofcom, Experiences of suspicious calls, texts and app messages 2026, data tables, March 2026, table 100. Online survey by Yonder of 2,154 phone users, 4 to 5 February 2026.
5. National Trading Standards AI scam watchlist launch, 30 September 2026, as reported by PA in the Irish News and National Technology.
6. FBI, public service announcement on generative AI fraud, 3 December 2024; Police Scotland, "Voice cloning scams".
7. Stop! Think Fraud (HM Government), "How to spot phone fraud", accessed 2 October 2026.