HIXORSpotting AI-Made Phishing Mail and Fake Ads — The "Bad Japanese" Tell Is Gone
Key points
- AI-written phishing mail has natural Japanese. "The wording looks odd, so it must be fake" no longer works as a test
- Check the destination, not the wording. Do not tap the link — open the official app or site yourself
- Investment ads using a celebrity's or official's face and voice, promising "government approved" or "guaranteed profit", are a known fraud pattern the police warn about
- "Fake boss" fraud uses a real executive's name to pull staff into SNS groups and demand transfers. Never decide a transfer from a message alone
Official sources
(Lead) Phishing mail used to give itself away with awkward wording. Now that AI writes the text, that tell is disappearing. What should you look at instead? This guide replaces "read the wording" with checks based on actions and destinations.
The tell that disappeared
Generative AI writes natural, polite business Japanese. A real-looking name or company logo is no longer evidence either. Judge by what the message asks you to do, and where it tries to send you.
Check the destination, not the wording
- Do not tap links in email or SMS. For banks, deliveries and shopping, open the official app or your bookmarked official site yourself
- On any page asking for a transfer, check whether the destination account is in an individual's name
- Look at the sender's actual address (not the display name) and whether it matches the official domain
The fake-ad pattern: a famous face and "government approved"
The National Police Agency warns about fraudulent ads misusing the images and voices of government figures. "Government-approved investment", "government guaranteed", "recommended by a celebrity" — this combination is a fraud pattern. Before investing, check whether the business is registered with the Financial Services Agency, and use the consumer hotline (188) or the police consultation line when in doubt. Real investments do not need "act now, limited offer" pressure.
Fake-boss fraud: the name is real, the instruction is not
Police also warn about fraud using real executives' names and company names to pull people into SNS groups and demand transfers. The countermeasures are simple:
- Never complete a transfer or contract on the basis of a message alone
- Share suspicious instructions with someone else in the company
- Decide the transfer procedure and approvers in advance, in normal times
Summary: today's checklist
- I check notices by opening the official app or site myself, never via message links
- I treat "government approved" and "guaranteed profit" investment ads as a fraud pattern
- Transfer instructions are never executed from a message alone
- I have 188 (consumer hotline) and #9110 (police consultation) saved as contacts
Review your current posture with 25 questions. Runs in your browser only.
Check your understanding
Tap an answer to check yourself. Nothing is saved or sent.
Q1. In the AI era, what is the right way to judge a suspicious message?
See the answer
Text and visuals can both be made convincing by AI. Choosing the destination yourself is the test that still works.
Q2. An ad says "government-approved investment, recommended by a celebrity". The right response is:
See the answer
The police warn about fraudulent ads misusing officials' images and voices.
Q3. You are invited to an SNS group under your president's name and asked to transfer money:
See the answer
Police warn about fake-boss fraud using real names. Transfers follow the procedure and approvals.
Read next
Stop Reusing Passwords — The First Step
Why reusing the same password is dangerous (credential-stuffing / password-list attacks) and how to stop, step by step, based on official IPA and JPCERT/CC guidance.
Read more →What Is the Cyber Threat Forecast? The Four Levels and How to Read Them
How to read the Cyber Threat Forecast, without technical terms: the four levels (Normal, Attention, Warning, Emergency), why Japan and the world have separate levels, and how to use the page day to day.
Read more →See the latest threat intelligence