Samples of Phishing Emails: 8 Examples and Red Flags

A phishing email is a message that pretends to come from someone you trust so you will click, log in, pay or reply. Below are eight sample phishing emails we wrote to mirror the patterns US agencies and universities warn about, with the red flags marked in each and a plain checklist for what to do next. The samples are constructed for teaching. The tactics behind them are real.

TL;DR

• Most phishing emails fall into a few patterns: account alerts, payment problems, fake invoices, shipping notices, refund offers and urgent requests from a “boss.”
• Check the sender’s real address, where the link actually goes, how the greeting reads and what pressure the message applies. Perfect spelling no longer proves an email is safe.
• Never click links or attachments in a suspicious message, including “unsubscribe.” Look up the company’s contact details yourself and reach out directly.
• If you already shared a Social Security, card or bank number, go to IdentityTheft.gov. If you entered a password, change it at once and turn on multi-factor authentication.

What a phishing email looks like

CISA says phishing messages may look like they come from a trusted organization and often use urgent or emotionally appealing language, incorrect email addresses or links, or untrusted shortened URLs. That is the whole genre in one sentence. The details change by brand and season, but the structure stays the same:

1. A sender who appears to be known to you.
2. A reason to act now.
3. A link, attachment, phone number or reply request that moves you off the safe path.

The Federal Trade Commission lists the most common stories: suspicious activity or login attempts, account or payment problems, requests to confirm personal or financial information, unrecognized invoices, and fake government refunds. Every sample below is a variation on one of those.

Eight sample phishing emails, with red flags

1. The “suspicious sign-in” alert

From: Microsoft Account Team security-alert@micros0ft-support.example
Subject: Unusual sign-in activity on your account

Dear user, we detected a sign-in from a new device in another country. If this was not you, verify your account within 24 hours or access will be suspended.

[Verify my account]

Red flags:

• The domain swaps the letter “o” for a zero. Government guidance on real examples points to spoofed addresses with subtle character substitutions.
• “Dear user” means the sender does not know your name.
• A 24-hour deadline with a threat of suspension is manufactured urgency.
• The button hides its destination. Hover over it before doing anything else, and treat any mismatch as a stop sign.

Safe move: Do not use the button. Open a new browser tab, type the service’s address yourself, and check your account’s security page.

2. The payment problem

From: Billing billing@streaming-service-help.example
Subject: Your payment was declined, update now

Hi jane.doe@yourmail.com, we could not process your monthly payment. Update your card details to avoid losing access.

Red flags:

• The greeting uses your email address instead of your name, a pattern Canada’s cyber safety agency lists among typical examples.
• The sender domain is a generic “help” site, not the company’s own domain.
• The message wants card details through an email link.

Safe move: The same agency’s advice is to go straight to the source, for example by calling the number on the company’s official website rather than relying on links in the email.

3. The unexpected invoice

From: Accounts Receivable ar@vendor-invoices.example
Subject: Invoice 48213 overdue, see attached

Please find the attached invoice for services rendered. Payment is now 15 days late. Open the attachment for details.

Red flags:

• You do not recognize the vendor or the purchase. “Unrecognized invoices” are on the FTC’s list of common phishing stories.
• The email says almost nothing and pushes you to open the attachment.
• A late-payment claim creates guilt and urgency together.

Safe move: Do not open the file. Check with your accounts payable team or the person who manages vendors. If you never ordered the service, report and delete the message.

4. The shipping notice

From: Delivery Notifications track@parcel-update.example
Subject: Package on hold, address incomplete

We could not deliver your parcel. Confirm your address and pay a $1.99 redelivery fee: bit.ly/xxxxxx

Red flags:

• A shortened link hides where you will land. CISA specifically names untrusted shortened URLs among the warning signs.
• A tiny fee is a hook: the goal is your card number, not $1.99.
• You may not be expecting a package at all.

Safe move: Open the carrier’s app or type its address yourself, and enter the tracking number from a real order confirmation.

5. The government refund

From: Tax Refund Department refunds@gov-benefit-claims.example
Subject: You are eligible for a refund of $842.16

Click here to claim your refund. Provide your Social Security number and bank details to receive payment.

Red flags:

• Fake government refunds appear on the FTC’s list of common phishing scams.
• A real agency does not ask you to send a Social Security number by email.
• A “.example” lookalike domain instead of an official government address.

Safe move: Delete it. If you believe you might actually be owed money, go to the agency’s official website on your own.

6. The boss who needs a favor

From: “Dana Whitfield, CEO” dana.whitfield.ceo@mailbox-secure.example
Subject: Quick task, are you at your desk?

I’m in a meeting and can’t talk. I need you to process a wire transfer today. Keep this confidential. I’ll send details.

Red flags:

• The display name is a real executive but the address is a free or unrelated mailbox.
• Secrecy and speed are used to stop you from checking with anyone.
• It asks for money movement.

Indiana University’s phishing education pages describe spear phishing in just these terms: impersonating a person of authority and urgently requesting a banking or wire transaction so you act without thinking.

Safe move: Call or message the executive using a number you already have, not one from the email. Finance teams should require a second approver for any new wire request.

7. The campus or workplace “license expired” notice

From: IT Helpdesk helpdesk@it-support-portal.example
Subject: [External] Your license has expired

Your Office license has expired. Sign in below to renew, or your mailbox will be deactivated.

University IT departments publish real examples of this kind of lure because it works. The University of Cincinnati keeps a Phish Bowl of real-life examples reported by its community, and it is worth browsing the page for your own school or employer to see the exact styles aimed at you.

Red flags:

• Real IT teams rarely threaten deactivation by email.
• The sign-in link leads to a page that looks like your login screen but sits on another domain.
• An “[External]” tag on a message claiming to be from inside your organization should make you slow down.

Safe move: Open your company’s IT portal from a bookmark. If you have a reporting button or a security mailbox, use it.

8. The perfectly written one

From: Customer Support support@secure-account-review.example
Subject: Action required on your recent order

Thank you for your continued business. We have identified a discrepancy on your account and kindly ask that you review the enclosed document at your earliest convenience.

There are no typos, no shouting and no threats, and that is the point. CISA notes that poor grammar used to be a common sign, but in the era of AI some emails now have perfect grammar and spelling. A calm tone is not proof of legitimacy.

Red flags: an unfamiliar sender domain, a vague “discrepancy,” and a document you did not ask for.

A five-place checklist for any suspicious email

When a message makes you hesitate, check these in order:

1. The sender address. Look past the display name at the actual address and domain. Watch for swapped letters, extra words and unrelated domains.
2. The greeting. “Dear customer” or your email address in place of your name is a weak signal on its own, but a useful one.
3. The link. Hover without clicking. Does the destination match the company? Shortened links deserve extra suspicion.
4. The ask. Logins, payments, gift cards, codes, wire transfers and “confirm your details” are the usual goals.
5. The pressure. Deadlines, threats, secrecy and too-good-to-be-true offers are tools to stop you from thinking.

Canada’s Get Cyber Safe publishes a flow chart for suspicious messages that walks through the same questions: sender’s address, spelling or blurry logos, urgency or threats, and odd requests. And because phishing is among the most common cybercrimes, NIST tells users to take a second, or third, look at any message asking them to click a link or transfer funds.

Do funny phishing emails exist?

People search for “funny” phishing emails because many scam messages are clumsy: absurd inheritance stories, mangled English, a prince with a very specific tax problem. Some of those are comic, and some are deliberately crude to filter out skeptical readers so scammers only spend time on the most trusting ones.

The trap is assuming that a silly message is harmless. Clicking a link in a funny email is as risky as clicking one in a serious one, and a tool that tracks clicks or loads remote content works the same either way. If you want to share an example with coworkers, send a screenshot and not the live message. Do not forward the original with its links active.

What to do when a suspicious email arrives

CISA’s guidance is short: if a message is suspicious, do not click links or attachments, report it and delete it. If it might be real, look up verified contact information and contact the company or person directly.

Two details people miss:

• Do not reply. Replying confirms your address is active.
• Do not click “unsubscribe.” CISA says to delete fraudulent messages without clicking any link or attachment, including links labeled unsubscribe.

At work, report first using your security team’s process. At home, use your email provider’s report-phishing option, then delete.

What to do if you already clicked or replied

Stay calm and act in the right order. What you do depends on what you gave away.

You only clicked a link. Close the page. Do not enter anything. Run a security scan on your device and watch your accounts for odd activity.

You typed a password. Change it right away on the real site, and on any other site where you reused it. Turn on multi-factor authentication. If this is a work account, tell your IT team immediately so they can check for forwarding rules and unusual sessions.

You shared a Social Security, credit card or bank account number. The FTC says to go to IdentityTheft.gov for steps based on the information you lost. Call your bank or card issuer using the number on the back of your card.

You opened an attachment. Disconnect from the network if you can, and contact IT or a trusted technician before doing anything else.

If a password may have leaked, our guides on what to do after a password breach and what to do after a data breach cover the follow-up steps in order.

Our perspective: you cannot out-read every phish

We build password and identity security tools, and we see the same pattern in the way people get caught. It is rarely carelessness. It is a busy person at 4:45 p.m. facing a message that looks routine. Training helps, but expecting a human to spot every well-made fake is a losing plan, particularly now that spelling is no longer a tell.

The better approach is to make a mistake survivable. Three habits do most of the work:

• Use a unique password for every account. A phished password then opens one door, not twenty. A password manager makes that practical. See why password management matters.
• Let the tool check the address for you. A password manager that autofills only on the saved site will not fill a fake login page, which is a quiet alarm in itself. Spend a minute on how secure password managers are if you are weighing the idea.
• Add a second factor, ideally one that does not depend on typing a code. Passwordless and biometric options remove the secret a phisher is trying to collect.

None of this replaces judgment. Slow down, verify through a second channel, and report what you see so the next person is not caught.

— Mike

Protect your accounts in case a phish gets through

If you want a safety net behind your own caution, LogMeOnce offers a password manager with plans for individuals and families: Premium is $0.00 per month, Professional is $2.50 per month and Family is $4.99 per month. For monitoring, Dark Web Monitoring is $1.67 per month, and you can run a free dark web email scan to see whether your address has appeared in known leaks. Teams can look at business plans, where Teams is $4.00 per user per month and Business is $7.99 per user per month.

Using samples to train your team

If you run security awareness at a small business or school, examples are your best material, with a few rules:

• Use current, local examples. Universities such as Cincinnati publish what is hitting their campus. Your own reported emails are better still.
• Mix categories. Include a payment alert, a document share, a boss request and one email that is real, so people learn to verify and not just to distrust everything.
• Teach the action, not just the signs. The sample should end with a question: what would you do next? Indiana University’s pages use scenario questions about clues, outcomes and next steps for this reason.
• Make reporting easy and blame-free. People who fear punishment hide mistakes, and the first hour after a click is when speed matters most.

FAQ

What are some good examples of phishing emails?

The classics are fake account alerts, declined-payment notices, unrecognized invoices, shipping problems and government refund offers. The FTC lists these themes as the usual stories. The eight samples above show each one with its red flags.

What is the most common trick in phishing emails?

Urgency combined with impersonation. The email claims to come from a company or person you trust and tells you something bad will happen unless you act now. Slowing down and verifying through a separate channel defeats most of it.

Can a phishing email have no spelling mistakes?

Yes. CISA notes that AI-era phishing can have perfect grammar and spelling. Judge the sender’s domain, the link destination and what the message asks you to do, not how polished it reads.

Should I forward a phishing email to coworkers as a warning?

Not as the original message. Use your company’s reporting button or security mailbox, or send a screenshot with the links removed. Forwarding the live email risks someone clicking it.

What if I am not sure whether an email is real?

Do not use anything in the message. Find the company’s phone number or website yourself and ask them directly. A legitimate organization will not mind the check.

Sources

• How To Recognize and Avoid Phishing Scams, FTC Consumer Advice
• Recognize and Report Phishing, CISA
• Real examples of fake emails, Get Cyber Safe
• What to do about a suspicious-looking message, Get Cyber Safe
• Phishing, NIST
• Stories and examples, Phishing Education and Training, Indiana University
• Phish Bowl, University of Cincinnati