How to avoid getting phished in the age of AI

Phishing is getting more sophisticated: What to look out for and how to protect yourself

Across all walks of life, email scams are increasingly more common and generative AI is making it harder for many of us to recognize signs of fraud. Academic publishing is not unaffected. Not so long ago, tell-tale markers such as spelling and grammatical errors or lines of text that didn’t quite sound professional made it easier to spot a phish, but today genAI can help fraudsters concoct a frighteningly convincing email.

This isn’t only because the spelling errors and lack of professionalism are gone — attackers can now research and leverage a target’s past activities (including actual publications, co-authors, and recent talks) to compose highly personalized emails, clone institutional writing styles, and use AI voice/video tools for follow-up “verification” if a target hesitates.

So, what can you do? How can you prepare yourself for this sort of threat?

First: know your enemy!

There are several classic types of scams in academic publishing. These include:

• Scammers impersonating a member of the editorial team, such as the Editor-in-Chief, other editor, or a publisher (e.g., Elsevier), and asking for a direct payment or other confidential information

• Fake acceptance letters asking for payment

• Predatory organizations asking researchers to contribute to a conference, edited volume, or journal (sometimes with the Elsevier name or logo attached) and asking for payment or other confidential information

• Colleagues asking for help or inviting you to click on a link

Elsevier journals and editors will never ask you to pay into a bank account directly, and editors will never ask for payment with the acceptance letter. Any publication fee payment form is sent by Elsevier with an "@elsevier.com" email address along with the proofs. Always verify any suspicious emails through another channel.

Second: be suspicious of these psychological techniques or hooks

• Flattery (“We read your very important work on X in the latest issue of Real Publication”). Especially when you’re an early career researcher, it can feel good to be approached by email to present your work at a conference or publish in an edited volume — but don’t let flattery fool you. Do a little digging on your own to learn more about the publication or organization. Think.Check.Submitopens in new tab/window provides some good guidance.

• Urgency paired with flattery/prestige (“click here to claim your VIP spot before the deadline”). Humans are curious creatures and messages like this can really pique your interest as well as the fear of missing out if you don’t act fast. Make it a habit to hover over any links before clicking to check the actual domain.

• Funding lures (“we’ve identified supplementary funding available through a partner initiative”). It’s pretty rare that people just randomly reach out to offer money. Be especially suspicious if accessing more information necessitates clicking on a suspicious link or sharing tax information/bank account details.

• The familiar face. A colleague reaches out and you’re excited to see their name pop up in your inbox. But then instead of the normal catch up, they’re asking for your help. Maybe they need you to pay for something online that almost makes sense for a collaborative project (but then again, why would your colleague do this?) or they want you to click on a link about a new opportunity (but the way they phrased that just doesn’t sound like something they’d say). If your “Spidey senses” are tinglingopens in new tab/window, make sure you check the sender’s email and compare it with your colleague’s familiar one. You should also verify any requests for payment with your colleague through another channel.

Third: watch out for these other red flags

• Screenshots of your accepted paper in Editorial Manager. Elsevier journals don’t send screenshots to confirm your acceptance. Always log in to Editorial Manager directly to check the status of your paper.

• A phone call or text about your paper acceptance. We only use email to update you when an editorial decision has been reached.

• Incorrect domain spellings (“elseveir.com” or “elsevier.edu”)

• Login pages that look pixel-perfect but load slowly, have a slightly incorrect URL, or ask for credentials twice.

What to do if you receive a phishing message

The number one rule of thumb here is: Don’t interact with the suspect email. If you doubt the legitimacy of a message, DO NOT reply. By engaging with fraudsters — even to say “I'm not interested” or “please stop emailing” — you may inadvertently provide or validate your email address and become a greater target in the future.

If you believe you have been targeted by a fraudulent email campaign, please delete the email, do not open any attachments, and block the sender. If you have any queries or concerns with an email purporting to be from Elsevier, you are always welcome to contact our Researcher Support teamopens in new tab/window.

Key takeaway

Whether it has to do with your research, a submitted article, or that random party invitation from someone you haven’t heard from in a while, make sure you always verify the sender's email address before acting on any request, be cautious of urgent or unusual asks — even from apparent colleagues — and never click links or share sensitive information unless you are certain of the sender's identity.

For previously published articles in Authors’ Update, see:

• Seven top tips on stopping APC scams

• Fraudulent emails requesting payment: a warning for authors

• Beware of fraudulent emails requesting payment

*This article was informed by experiences of Elsevier customers and journals, but we also asked Claude to give us some insider information about what AI can do. The insights were both illuminating and scary!