Stop Damage Fast: 7 Step Response and Sample Phishing Email Templates

A sample phishing email almost always tries to get you to act fast: click a link, open a file, or hand over a password before you think it through. The three fastest tells are a sender address that does not quite match the real company, a link whose destination does not match its visible text, and a request for credentials, payment, or personal data under time pressure. The examples and checks below walk through both.

TL;DR:

• Phishing emails often create a false sense of urgency, such as claiming account issues or alleging security threats, to prompt quick reactions.
• Common signs include misleading sender addresses, mismatched links, unexpected attachments, and requests for sensitive information or payments.
• Hovering over links and checking full sender details can reveal domain mismatches or malicious redirects before clicking.
• Immediately disconnect from the network, change affected passwords, and notify IT or banks if credentials or financial information are compromised.
• Regular habits like using unique passwords, multi-factor authentication, and verifying requests through known contact channels significantly reduce phishing risks.

Sample phishing emails by common attack type

Most phishing messages fall into a handful of templates. Seeing the pattern makes the next one easier to spot, whether it lands in your inbox or a coworker forwards it to ask if it’s real.

• Account alert: Subject reads “Unusual sign-in activity detected.” The body claims your account was accessed from a new device and asks you to “verify your identity” through a link. Red flags: sender domain is close but not exact (like “security-alerts-support.com”), the link text says your bank’s name but hovers to a different domain, and the message demands action within 24 hours. Goal: credential theft.
• Invoice or payment request: Subject reads “Invoice #4471 overdue.” An attached PDF or Excel file claims to be a bill. Red flags: an unexpected attachment from an unfamiliar vendor, a file extension like .exe disguised as .pdf, and pressure to pay immediately to avoid late fees. Goal: malware installation or wire fraud.
• Shipping notification: Subject reads “Your package could not be delivered.” The message asks you to “confirm your address” via a link. Red flags: generic greeting (“Dear Customer”), a shortened or obscured URL, and no order number matching anything you actually bought. Goal: credential theft or malware.
• Shared document: Subject reads “John shared a file with you on SharePoint.” Red flags: the sender’s name looks familiar but the email address does not match their usual one, and the link leads to a login page asking for your work credentials outside your company’s actual portal. Goal: credential theft.
• HR or training notice: Subject reads “Mandatory security training due today.” Red flags: urgent, authority-driven language, a login page that mimics your company’s single sign-on screen, and a request for your username and password on a page with a slightly wrong domain. Goal: credential harvesting at scale.
• Colleague or executive impersonation: Subject reads “Quick favor.” The message appears to come from a manager and asks you to buy gift cards or process a wire transfer, often from a personal-looking email address. Goal: direct financial loss.

Pro Tip: Save real phishing examples your team receives (with headers intact) and reuse them as internal training samples instead of generic stock templates.

Why these tricks work and how to spot them fast

Phishing works because it borrows from how people already make decisions under pressure. CISA’s guidance on recognizing phishing attempts points to urgent or emotionally charged language, requests for sensitive information, generic greetings, and suspicious hyperlinks as the core, recurring signals, regardless of how the message is dressed up.

Four tactics show up again and again:

1. Urgency: a countdown, a deadline, or a threat of account suspension pushes you to skip verification.
2. Authority impersonation: the message poses as a bank, employer, or government agency to borrow trust you would not extend to a stranger.
3. Social proof: language like “other employees have already completed this” nudges you to comply without questioning it.
4. Helpfulness or fear: offers of a refund, a prize, or a warning about a security breach trigger a quick, emotional response instead of a careful one.

Once you know the tactic, the checklist is short: does the sender address match exactly, does the link’s real destination match its visible text, is there an attachment you did not expect, and is the message asking for credentials, payment details, or a money transfer?

**Statistic callout: ** The FTC’s guidance on phishing scams notes that legitimate companies typically will not ask you to send sensitive information through an email link, which makes that single request one of the most reliable signals on its own.

Grammar is no longer a dependable clue. CISA has noted that the underlying behavioral trigger, urgency and borrowed authority, persists even as AI-assisted writing makes phishing emails read more smoothly than they used to.

How to safely inspect links, attachments, and senders

Before you click anything, hover your cursor over the link (without clicking) and look at the preview that appears in your browser or email client’s status bar. If the visible text says “yourbank.com” but the preview shows a different domain, that mismatch alone is enough to stop. CISA’s guidance on social engineering points out that HTML emails can display legitimate-looking text while the actual coded link sends you somewhere else entirely.

• Check the sender’s full email address, not just the display name, for lookalike domains (an extra letter, a swapped number, a different top-level domain).
• Treat unexpected attachments, especially .exe, .zip, or macro-enabled Office files, as suspicious until scanned.
• If you need to verify a request, open a browser and type the company’s known address directly instead of clicking the link.
• Run suspicious links through a URL scanner before visiting, or open attachments on an isolated or secondary device if you must check them at all.

Pro Tip: When in doubt, call the sender using a phone number you already have on file, not one listed in the email.

What to do if you clicked, opened, or entered credentials

Acting fast limits the damage. Work through this in order:

1. Disconnect the device from Wi-Fi or unplug the network cable to stop any background activity.
2. From a separate, clean device, change the password for the affected account and any account sharing that password, then turn on multi-factor authentication.
3. Run a full malware scan on the affected device and update your operating system and antivirus software.
4. If this happened on a work account, notify your IT or security team immediately so they can check for wider exposure.
5. If you entered financial details, contact your bank or card issuer to flag possible fraud.
6. Report the email: forward it to APWG at reportphishing@apwg.org, and file a report with the FTC at ReportFraud.ftc.gov.
7. Preserve evidence, screenshots and the original email with headers, but do not forward the malicious email widely beyond official reporting channels.

For a fuller walkthrough of recovering after exposure, see our guide on what to do after a data breach.

Everyday prevention habits that actually hold up

Most phishing defenses come down to a few habits done consistently, plus some basic organizational hygiene.

• Use a password manager and unique passwords for every account so one stolen password does not unlock everything else.
• Turn on multi-factor authentication wherever it’s offered.
• Keep your operating system, browser, and apps updated to close known security gaps.
• Never click a link in an unexpected email, even if it looks legitimate; type the address yourself instead.
• For organizations, set up SPF, DKIM, and DMARC on your email domain, run periodic phishing simulations, and give employees a one-click way to report suspicious messages.
• Use breach and dark web monitoring so you find out quickly if a password has already leaked, rather than finding out from fraud.

Our guide to IT security habits covers more of the organizational side, including training cadence and reporting channels.

Why habits matter more than spotting the perfect fake

The mistake most people make isn’t falling for an obviously fake email. It’s assuming they’d never fall for one, then clicking fast on a message that looks almost right. The habit that cuts clicks the most isn’t vigilance, it’s friction: pausing before you act on any request involving money, credentials, or urgency. Pair that with unique passwords and monitoring for leaked credentials, and a single bad click stops being a catastrophe.

— Mike

Where protective tools fit alongside good habits

Spotting a sample phishing email is half the job. The other half is limiting the damage when one slips through, which is where a password manager, dark web monitoring, and multi-factor authentication earn their place. LogMeOnce’s password manager stops a single stolen password from unlocking every account, its dark web scan flags credentials that have already leaked, and its passwordless MFA removes the password step phishing pages are built to steal. None of this replaces careful reading, it backs it up. Compare plans on the pricing and comparison page if you want to see what fits your setup.

FAQ

What’s a common trick used in phishing emails?

Attackers rely heavily on urgency, like a fake security alert or a payment deadline, to get you to act before you check the details. CISA’s phishing guidance lists urgent language, requests for sensitive information, and generic greetings as the recurring pattern across most scams.

What does a phishing email address look like?

It usually mimics a real company’s domain but with a small change, an extra word, a different top-level domain, or a misspelling that’s easy to miss at a glance. The display name might say “Amazon Support” while the actual address belongs to an unrelated or slightly altered domain.

What are some examples of funny phishing emails?

There is no official database of “funny” phishing emails, since most are designed to look routine rather than entertaining. The odd ones that do stand out are often poorly translated scam offers or oddly specific prize notifications, which still rely on the same urgency and reward triggers as more convincing attempts.

Can I get phished just by opening an email?

Opening a plain email is generally low risk, since the danger usually comes from clicking a link, opening an attachment, or entering information on a fake page. The FTC has also flagged newer scams, including fake CAPTCHA prompts that instruct users to run commands that install malware, so treat any unusual on-screen instruction with the same caution as a suspicious link.

Sources

CISA and the FTC publish the primary, government-backed guidance referenced throughout this article, and both accept phishing reports. APWG maintains a long-running archive built from user-forwarded phishing emails and accepts reports at reportphishing@apwg.org. For financial losses or business email compromise, the FBI’s Internet Crime Complaint Center (IC3) is the appropriate law enforcement reporting channel.

• Recognize and Report Phishing | CISA
• How to recognize and avoid phishing scams | FTC

Sadia Israr

Sadia, with her Master of Computer Applications, stands at the intersection of technology and communication. Her academic background has endowed her with a deep understanding of complex technical concepts, which she skillfully simplifies for diverse audiences. Sadia’s extensive experience in both technical realms and writing enables her to translate intricate technical ideas into clear, engaging, and accessible content.