The Typos Are Gone: What the FBI and CISA Phishing Warning Means for You

On 16 October 2026 the FBI and CISA issued a joint public service announcement warning election officials, candidates and campaigns about phishing, smishing and AI-generated deception ahead of the US midterm elections. The audience is specific, but the lessons are not. Anyone whose job gives them access to sensitive data, money or accounts is in a similar position, and the techniques described are the ones every organisation now has to plan for.

What the FBI and CISA actually said

The announcement (alert I-101626-PSA) says election officials, candidates and their political organisations are attractive targets because of the voter data they can reach, their status as government officials and the sensitive campaign information they hold. It says officials experienced a surge of phishing attempts during the last two election cycles, and that the FBI has seen an increase in smishing attempts through encrypted chat applications over the past year.

The warning covers phishing aimed at stealing credentials, smishing (text and chat messages that try to extract information or deliver harmful content), and the use of AI to make both more convincing, including deepfake audio and video. It does not name a threat actor, a campaign or an incident. That matters: this is guidance about techniques that have been used in past election cycles, not a report that a particular attack has happened.

Why flawless writing changes the job

The announcement says AI-generated messages can "appear genuine, using native languages and common vernacular", which makes them harder to spot than the older phishing emails with clumsy spelling and grammar. It also says attackers are using AI tools that learn over time to make automated phishing more effective.

Spelling mistakes were never a dependable defence, but a lot of awareness advice leaned on them. When a message reads like it came from a colleague, "does this look wrong?" stops being a useful question. The better question is "is this request one I would normally act on without checking?" Our look at AI spear phishing at scale covers the research behind the same shift.

Why text and chat apps deserve their own attention

Smishing reaches people on phones and in messaging apps. Our reading of this, rather than something the announcement states, is that those channels often sit outside the filtering and logging an organisation applies to email, so a message can arrive with fewer checks between the sender and the person. If you want the wider picture, see how smishing works and why phishing keeps moving to personal phones and chat apps.

The practical point is that a security awareness programme which only talks about email leaves a gap. People need the same habits for a text from a "colleague", a chat message from an unknown number and an email.

Deepfakes and borrowed identities

The announcement states that threat actors use deepfakes to create new identities and to steal the identities of real people, and that AI-generated audio and video can support phishing schemes. It gives no specific incidents, so treat it as a description of capability rather than a count of attacks.

What follows for everyday work is simple. A familiar voice on a call or a familiar face on a video link is no longer proof of who is asking. Requests for money, credentials or access need a check that does not depend on how convincing the person sounds. We cover one example in voice clone CEO fraud.

The habit that still works

The agencies advise people to confirm sensitive requests through a secondary channel where possible. The diagram shows why that holds up when everything else fails: the check never relies on spotting a flaw in the writing, the voice or the image.

Two details make this work in practice. The second channel has to be one the person already trusts, such as a number from the company directory or an internal chat they opened themselves, and never a link or number inside the message. And the "report it" branch matters as much as the "act" branch, because a report from one person can protect everyone else who received the same message.

Where organisations tend to leave gaps

This section is our analysis rather than the agencies' findings. In practice, the high-access roles get the same generic guidance as everyone else, even though they are the ones attackers research. A finance approver, an IT administrator and an executive assistant each hold something different, and a lure that suits one will not suit another. Short, role-specific examples land better than a single annual course.

Verification also fails when nobody knows who to call. If the only way to check a request is to message the person who sent it, the check is worthless. A maintained list of trusted contact routes for finance, IT and senior staff costs very little and removes the excuse to skip the step. Finally, reporting needs to feel safe. People who worry that reporting a mistake will be held against them stay quiet, and the next recipient of the same message has no warning.

What the agencies recommend

The announcement and the related CISA, NSA, FBI and MS-ISAC phishing guidance list steps for individuals and organisations. The organisational ones include:

• Use phishing-resistant multi-factor authentication (MFA), especially for email, VPNs and critical systems. Our post on passkeys and phishing resistance explains what that means.
• Train staff to recognise phishing and smishing, and to confirm sensitive requests through a secondary channel.
• Give people a simple way to report suspicious emails to IT, and tell them not to open attachments from unknown senders.
• Add banners to external emails, and use SPF and DKIM to limit domain spoofing.
• Run current anti-malware tools and strong spam filters, and block emails with executable attachments.
• Apply role-based, least-privilege access and review it regularly, and keep operating systems and software patched.

None of these steps stops every attack. They work as layers: the technical controls reduce what reaches people, MFA limits the damage when a credential is handed over, and prepared people catch some of what gets through and report it quickly.

The bottom line

The FBI and CISA wrote for people who run elections, but the message applies to finance teams, executive assistants, IT administrators and anyone else with access worth stealing. Writing quality can no longer serve as the test of a message. Equip people with a habit that does not depend on it: pause on any request for a login, a click, a code or a payment, check it through a channel you trust, and report what looks wrong.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.