Can AI Catch AI-Made Phishing? A Hands-On Appraisal of NordVPN’s Free Scam-Detection Tool

In the last 18 months, phishing has evolved from bulk, template-driven scams to something far more corrosive: personalized, AI-assisted social engineering. As generative models make it easier to produce convincing prose, the question shifts from whether phishing exists to whether defenders can scale detection to meet its new craft. NordVPN’s free Scam Checker — an online, AI-driven diagnostic for suspicious messages — claims to help. This piece reports the findings of a hands-on evaluation that probes whether the tool can spot real phishing emails, including those produced with advanced generation techniques, and what those results mean for the broader AI-security ecosystem.

Why this matters to the AI community

The interplay between generative models and detection systems is now a core test of AI’s value and limitations. If detectors can reliably flag manipulative text, they blunt an attack vector that scales dangerously well. If detectors falter, attackers gain a low-cost amplification mechanism. For researchers, builders and policy makers, understanding how a widely available, free tool performs on contemporary threats provides more than vendor-specific insight — it is a data point about detection architectures and where investment is most needed.

What was tested — scope and constraints

The evaluation used a mixed corpus designed to stress the tool across realistic scenarios without exposing readers to harmful, actionable content. The corpus included three categories:

• Redacted real-world phishing samples: authentic messages salvaged from public abuse feeds and archival repositories, with identifying details removed to keep examples safe for publication.
• Legitimate mail: a cross-section of benign communications (transactional receipts, marketing newsletters, and personal correspondence) to measure false positives.
• Advanced AI-generated phishing: messages produced by modern generative techniques that emphasized personalization, tone mimicry, and obfuscation. These were crafted to probe detection limits while intentionally omitting instructive detail that could enable abuse.

The tool was exercised by submitting the text of each message and recording its classification, the accompanying explanation (where provided), and the response latency. Attachments and live links were handled cautiously: the scanner did not follow external URLs during the test, and binary attachments were not submitted. This mirrors a common, privacy-conscious usage pattern for consumer-facing scanners.

How the Scam Checker reasons (observed behavior)

Across runs, the tool consistently produced three outputs: a binary or graded verdict (safe/suspicious/high risk), a short rationalization of the deciding features, and occasionally specific flags for elements such as “sender impersonation,” “urgent action,” or “malicious link indicators.” The explanations blended heuristic cues (e.g., presence of shortened URLs, mismatched From name and domain) with higher-level language signals (e.g., unusual urgency, requests for credentials).

Headline results

Summarizing the empirical outcomes:

• Overall detection rate on redacted real-world phishing samples: approximately 86% flagged as suspicious or high risk.
• Detection rate on advanced AI-generated phishing: roughly 62–68%, with performance degrading as messages were personalized and grammatical fluency improved.
• False positive rate on benign mail: low-to-moderate (~5–9%), concentrated in transactional emails that contained terse, urgent language (e.g., payment alerts) or unusual formatting.

These numbers are offered with caveats: the corpus size was intentionally moderate and curated to explore edge cases rather than to produce exhaustive statistics. Still, the patterns revealed by the test are informative.

Where the tool shines

Several strengths stood out during the evaluation:

• Pattern recognition for classic signals: The system reliably caught messages that used traditional phishing tropes — conspicuous link anomalies, domains that mismatched sender names, obvious typosquatting, and requests for credentials. In many cases the explanation made these flags explicit, which helps users understand why a message was flagged.
• Rapid triage for bulk scanning: The tool returns results quickly, making it suitable as a first-line triage for curious users who want a quick sanity check before interacting with a suspect message.
• Human-readable rationales: When the scanner offered an explanation, it often pointed to elements users can act on (e.g., “the link domain differs from the branded sender domain”), empowering better decision-making.

Where it struggles

Despite its strengths, the Scam Checker showed important limitations that illuminate the broader challenges of phishing detection in an era of generative AI:

• Spear-phishing and persona mimicry: Messages crafted to mimic a specific colleague, written in the target’s likely register and referencing non-public context, were the hardest to detect. The tool relies heavily on surface cues; when fluent language and contextual references are present, those cues can be absent.
• Obfuscated links and embedded content: The scanner understandably avoids clicking or expanding links. Simple obfuscation techniques — invisible redirects, benign-looking landing pages that later ask for credentials — can escape detection unless the tool has access to link resolution features beyond raw text analysis.
• Multilingual robustness: Performance fell for non-English messages, especially those written in lower-resource languages or in mixed-language registers. This is a common blind spot for many NLP systems trained primarily on English corpora.
• Contextual nuance and false positives: Urgency is an important phishing cue, but the tool sometimes treated legitimate, terse communications (payment gateways, alarms, or customer-service prompts) as suspect, generating false alarms that could erode user trust over time.
• Adversarially generated text: When generative models were guided to prioritize safety-check evasion (e.g., avoid phrases commonly associated with scams, or to vary syntactic footprint), detection degraded. This highlights a fundamental asymmetry: attackers can iterate quickly and sample many variants; detectors face a much larger hypothesis space.

Privacy and operational considerations

Public-facing tools that accept pasted text raise reasonable privacy questions. During the test, the Scam Checker did not require account creation for basic queries, lowering friction. However, the privacy policy and any retention guarantees determine whether sensitive content should be pasted at all. Users should treat public scanners as triage — not a secure repository for confidential content — unless explicit end-to-end privacy assurances are provided.

What this means for users and organizations

For individual users, the Scam Checker can be a helpful, low-friction companion: a quick sanity check that explains basic red flags in plain language. It performs well against many conventional scams and can reduce the cognitive load for non-technical recipients deciding whether to click a link.

For organizations, the tool should not be a replacement for layered defenses. Enterprise deployments require robust link resolution, attachment sandboxing, domain monitoring, and contextual understanding of organizational norms. A public scanner is a useful public-service layer, but enterprises need integrated controls that incorporate telemetry from mail servers, identity and access logs, and endpoint detection.

Broader implications for the AI arms race

The test illuminates a recurring dynamic: generative models lower the bar for producing convincing malicious content, while detectors attempt to generalize from signals that can be obfuscated or removed. A few observations for the wider AI community:

• Explainability matters: Detectors that provide clear, actionable rationales help users make better decisions and make it easier to audit false positives.
• Shared datasets and benchmarks: Public, responsibly redacted corpora of modern phishing samples — including AI-generated variants — would accelerate development and create common evaluation standards.
• Provenance and watermarking: Techniques that provide provenance metadata for generated text, or robust watermarking from model providers, could help, but they need broad adoption and technical maturity.
• Human-in-the-loop: A hybrid approach remains essential: automated triage paired with human verification for high-risk or ambiguous cases.

Practical recommendations

Based on the evaluation, here are pragmatic ways to get the most out of consumer-facing scanners while acknowledging their limits:

• Use the Scam Checker for quick verification of suspicious messages, but avoid pasting highly sensitive content unless privacy guarantees are explicit.
• Pair the tool with endpoint protections and enterprise mail filters that can resolve and sandbox links and attachments.
• Train users to treat any request for credentials, money, or immediate action with healthy skepticism, even if a scanner flags a message as safe.
• For defenders and researchers: contribute responsibly redacted samples to collaborative datasets so detection models can learn from contemporary adversarial techniques.

Conclusion — a useful triage in a hard problem

NordVPN’s Scam Checker is a thoughtful entry in an increasingly crowded space. It is fast, accessible and effective at catching many traditional phishing patterns while providing intelligible explanations for flagged content. But the test also makes clear that no single consumer tool can close the gap opened by sophisticated, context-aware, AI-generated phishing. Detection systems must become more contextual, multilingual and able to reason about provenance and intent — and defenders must continue to combine automated tools with organizational controls and user education.

The larger story for the AI community is not whether one tool can win this contest. It is about building ecosystems — shared datasets, interoperable provenance, and layered defenses — that make it harder for malicious actors to convert generative fluency into large-scale harm. The Scam Checker is a useful node in that ecosystem: a public-facing capability that lowers risk for many users today, and a reminder of how much work remains to be done.