News
Which? says a reporter received a bogus paid lecture invite from a fake HR manager, generated by AI using her public LinkedIn profile and articles.
Reported by
Which?According to Which?, a journalist there was invited to deliver a paid guest lecture by an HR manager at an overseas university. The email praised her specific area of expertise and the way she writes about consumer finance, then offered money on flexible terms. It was fake, built using artificial intelligence to profile her and craft the approach.
This is spear-phishing: phishing aimed at one person instead of thousands. A normal phishing email is sent wide and hopes a small fraction of recipients bite. A spear-phishing message is built around a specific target, using details that make it feel personal rather than generic. What used to take a scammer hours of trawling social media, professional profiles, news articles and leaked data now takes an AI tool seconds.
The email worked because it named something true. It described the journalist's actual beat, her reporting on scams and data protection, and the way she explains financial issues clearly. None of that was guessed. It was pulled from her public footprint and assembled into a flattering, plausible pitch, then followed by the offer that made it worth acting on: paid work, on her schedule.
That sequencing is the mechanism. Accuracy first, to earn trust. Flattery second, to lower guard. Money third, to prompt action. A reader checking only for bad grammar or a strange link will miss this entirely, because there is none. The tell is not in how the message looks. It is in why a stranger would already know this much about the reader.
The UK government's 2025/26 Cyber Security Breaches Survey found that a quarter of charities and more than a third of companies had experienced phishing attacks. Which? points to AI as a major driver of the increase, specifically because it removes the manual labour that once limited how many personalised attacks a scammer could run at once.
This is the kind of pattern worth watching for: a message that gets your job, your work and your public profile right, arriving with an offer attached. That combination, correct personal detail plus a financial hook, is what separates a targeted attempt from a mass one, and it is becoming cheaper for scammers to produce at scale.
The journalist in this case spotted the scam before it could cause harm. Anyone with a visible professional profile, a LinkedIn page, published articles, conference appearances, is the kind of target this approach is built for. The starting point is recognising that being named and flattered accurately is not proof a message is genuine.
