How to Tell If an Email Was Written by AI

The honest answer to how to tell if an email was written by AI is that you often cannot, that the tools sold to do it for you are less reliable than their marketing suggests, and that in almost every case where the question matters, authorship is not the question you actually need answered. That is an unsatisfying opening, so this piece does three things: lists the signals that genuinely carry information, explains precisely why automated detectors fail and in which direction they fail, and reframes the problem into one that can be answered decisively.

The signals that carry real information

Large language models do not produce random text. They produce text that sits close to the centre of a learned distribution, and that centrality is what leaves traces. The following patterns are worth something when several appear together in a message that also has other reasons to be suspicious.

Uniform structure. Machine-drafted email tends toward paragraphs of similar length, sentences of similar length, and a predictable three-part shape: pleasantry, body, call to action. Human email is lumpier. People write one-line paragraphs, then a long one, then a fragment.

Low burstiness. Related to the above but measurable: human writing alternates between complex and simple sentences unevenly. Model output smooths that variance out. A message where every sentence lands between fifteen and twenty-five words is unusual.

Absent idiosyncrasy. No typos, no double space after a full stop, no trailing “thanks!” with the exclamation mark that person always uses, no reply chain quirks, no idiom that is specific to the sender’s team. Correctness is not itself suspicious, but the complete absence of personal texture in a message from someone whose texture you know is.

Register that does not match the relationship. A colleague of four years opening with “I hope this message finds you well” and closing with “please do not hesitate to reach out” is drafting through something. That may be a translation tool, an accessibility aid, or a phishing kit. It is not by itself evidence of any of them.

Hedged connective phrasing. Constructions such as “it is worth noting that”, “that said”, and “moreover” appear at elevated rates in model output relative to informal correspondence.

Generic specificity. The message references your role, your company, and your project in ways that are individually correct but never descend to a detail only a real correspondent would know. This is the tell that matters most for security, because it is the one that survives an attacker’s editing pass.

Content that is confidently wrong about a verifiable detail. Fabricated references, a meeting that never happened, a policy number in the right format that does not exist. Models confabulate; the pattern is a plausible-shaped fact rather than a vague one.

None of these is decisive alone. Together, in a message that also arrives unexpectedly and asks for something, they raise the prior enough to justify verification.

Why AI-text detectors fail, and which way they fail

This is the part that most guidance omits, and it is the reason to be careful with any tool that returns a percentage.

The strongest published evidence comes from a Stanford-led study, GPT detectors are biased against non-native English writers, which ran seven widely used GPT detectors against two essay corpora. Against essays written by US eighth-graders the detectors performed close to correctly. Against TOEFL essays written by non-native English speakers, more than half were misclassified as AI-generated, with an average false-positive rate above 60 percent; roughly one in five of those essays was flagged as machine-written by all seven detectors simultaneously, and the overwhelming majority were flagged by at least one.

The mechanism is direct. Detectors lean heavily on text perplexity — how surprising the word choices are to a language model. Writers with a smaller working vocabulary in the language they are writing in produce lower-perplexity text, which is exactly the property detectors read as “machine”. The same study showed that prompting a model to rewrite the essays with more literary language pushed them back across the line into “human”, which means the bias runs in both directions at once: it penalises the people least able to contest the accusation, and it is trivially defeated by anyone who wants to defeat it.

Vendor behaviour reflects the same limits. OpenAI withdrew its own AI Text Classifier on 20 July 2023, citing a low rate of accuracy. At launch the company had reported that on its challenge set the tool correctly identified 26 percent of AI-written text while incorrectly labelling 9 percent of human-written text as AI-written, and warned it was unreliable below roughly 1,000 characters — which is most email.

Three practical conclusions follow. A detector score is not evidence. A low-scoring message is not cleared. And running colleagues’ or applicants’ writing through a detector and acting on the output is a discrimination risk before it is a security control. The same evidentiary ceiling appears in other modalities — benchmark accuracy that does not survive contact with production is the central finding in deepfake detection methods 2026 as well.

The question that can actually be answered

Nobody asks whether an email was AI-written out of literary curiosity. They ask because they are deciding whether to trust it. That decision does not depend on authorship, and reframing it makes the problem tractable:

• Is this message from who it claims to be from? Answerable with high confidence.
• Is the thing it is asking for reasonable, and does the process it is using match how this normally happens? Answerable with high confidence.
• Was a model involved in drafting it? Not reliably answerable, and irrelevant to the first two.

A legitimate email drafted with AI assistance is fine. A fraudulent email written entirely by hand is not. Authorship correlates with neither outcome.

Verifying the sender instead

Authentication answers the first question, and it is deterministic rather than probabilistic.

Read the authentication results, not the display name. Mail servers stamp an Authentication-Results header recording SPF, DKIM, and DMARC outcomes. RFC 7489 defines DMARC’s core contribution: identifier alignment. SPF and DKIM each validate a domain, but not necessarily the domain the recipient sees in the From: header. DMARC requires the authenticated domain to align with the visible one, which is the check that matters for impersonation. A dmarc=pass on a message whose From: domain is the organisation it claims to be is meaningful. A dmarc=none result means the domain owner published no policy, so nothing was enforced.

Compare From:, Return-Path:, and Reply-To:. A mismatch, particularly a Reply-To: pointing somewhere unrelated, is a stronger signal than any prose analysis.

Look at the domain itself, character by character. Lookalike registrations, additional subdomains that place a trusted brand to the left of the real registrable domain, and homoglyph substitutions all survive an AI-polished body perfectly.

Verify out of band for anything consequential. The FBI’s Internet Crime Complaint Center advisory on generative-AI-facilitated fraud recommends creating a secret word or phrase with your family to verify identity, and verifying a caller by hanging up, looking up the organisation’s own published number, and dialling that rather than anything supplied in the message. Applied to email, that means reaching the purported sender through a channel you already had. This is the only control on the list that holds regardless of how good the generated text gets, which is why it belongs in a documented process rather than in individual judgement.

Where authorship does matter

There is one case where detecting machine generation is genuinely useful: volume. A single message tells you little, but a corpus tells you a lot. Fifty messages arriving across an organisation with near-identical rhetorical structure, matched paragraph counts, and per-recipient personalisation slotted into a fixed template is a campaign signature, and it is visible at the aggregate level even when no individual message would be flagged. That is a detection-engineering problem for a mail security platform rather than something a recipient can assess, and it is covered from the attack side in how to detect AI-generated phishing.

A workable policy

For an organisation writing this into a procedure, the defensible version is short:

1. Do not deploy AI-text detectors as an authority on human authorship, and never as an accusation. The published false-positive behaviour makes that indefensible, particularly for non-native English speakers.
2. Train the structural signals above as prompts to verify, never as verdicts.
3. Make verification cheap and expected. CISA’s phishing guidance puts the weight on controls that limit damage after a successful lure — phishing-resistant multi-factor authentication, least privilege, and monitoring — precisely because message-level detection will keep missing some percentage.
4. Enforce DMARC on your own domains so that recipients can answer the sender question about you, and so that alignment failures on inbound mail are actionable.

The uncomfortable summary is that fluent, well-structured, correctly spelled email is now the baseline for both legitimate and malicious mail, and the industry spent twenty years teaching people to read it as a trust signal. Recovering from that means moving the check from the prose to the process. To track how this detection problem develops, the personalized AI-Sec digest builder filters this site’s coverage down to detection and phishing topics on the cadence you choose.