Remember when scams were at least entertaining? Nigerian princes offering castles in Lagos, typos everywhere, laughable grammar. Generative AI killed that.

The new wave of phishing isn’t flashy, it’s boring. Fake DocuSigns, awful procurement PDFs, employee reimbursement requests, all annoying routine paperwork, written in flawless corporate English, with fake documents polished enough to pass a casual review.

I wrote up a few recent examples we caught (including a full fake vendor onboarding pack for Carnival UK). I think the new red flag isn’t drama or urgency. It’s when something looks “too normal.”