The scam knows your holiday. That proves nothing.

An unexpected message mentions the trip you just took. It sounds like someone who knows you. That little moment of recognition is exactly what makes this story worth taking seriously: knowing something about your life is not the same as being entitled to your money, password or attention. The research behind the Fox News/CyberGuy report examines how generative AI can turn public social-media context into personalized phishing messages. The authors' preprint, revised in September, reports a user study in which generated messages attracted less suspicion than a comparison set of real phishing emails. That is evidence of a persuasion problem in the study, not a count of stolen accounts or proof that every recipient would click. My concern is the shrinking usefulness of a familiar safety shortcut. We have taught people to notice generic greetings, awkward wording and messages that seem unrelated to their lives. Those can still be clues, but their absence cannot establish trust. A convincing personal detail may simply be a public detail repackaged. The practical response should not be to blame people for sharing a holiday or celebrating a child. It is to separate recognition from verification. When a message asks for a consequential action, use a phone number, saved app or website you already trust, rather than the route supplied in that message. That is also the FTC's advice. For workplaces, the same principle belongs in payment and account-recovery procedures. Staff should be able to pause an apparently urgent request without being punished for slowing things down. Better language generation changes the attacker's presentation; an independent check can still change the outcome.