For twenty years we taught people to catch phishing by spotting bad grammar. Generative AI writes clean, personalized lures, so that tell is dead. The real defense is a verification habit and a no-blame reporting culture.