{"id":248443,"date":"2026-10-27T00:00:30","date_gmt":"2026-10-27T00:00:30","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/"},"modified":"2026-10-27T00:00:31","modified_gmt":"2026-10-27T00:00:31","slug":"samples-of-phishing-emails","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/","title":{"rendered":"Samples of Phishing Emails: 8 Examples and Red Flags"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>A phishing email is a message that pretends to come from someone you trust so you will click, log in, pay or reply. Below are eight sample phishing emails we wrote to mirror the patterns US agencies and universities warn about, with the red flags marked in each and a plain checklist for what to do next. The samples are constructed for teaching. The tactics behind them are real.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"strip\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(14px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"flex-wrap:wrap;align-items:center;gap:16px 22px;padding:20px 24px\">\n<div style=\"flex:1 1 260px;min-width:0\">\n<div style=\"margin:0 0 8px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:19px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Build Stronger Digital Security<\/div>\n<div style=\"font-size:14px;line-height:1.5;color:#64748b;margin-top:4px\">Explore LogMeOnce resources on password management, multi-factor authentication and other tools for protecting digital identities and data.<\/div>\n<\/div>\n<div style=\"flex:0 0 auto\"><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#What_a_phishing_email_looks_like\" >What a phishing email looks like<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Eight_sample_phishing_emails_with_red_flags\" >Eight sample phishing emails, with red flags<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#1_The_%E2%80%9Csuspicious_sign-in%E2%80%9D_alert\" >1. The \u201csuspicious sign-in\u201d alert<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#2_The_payment_problem\" >2. The payment problem<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#3_The_unexpected_invoice\" >3. The unexpected invoice<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#4_The_shipping_notice\" >4. The shipping notice<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#5_The_government_refund\" >5. The government refund<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#6_The_boss_who_needs_a_favor\" >6. The boss who needs a favor<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#7_The_campus_or_workplace_%E2%80%9Clicense_expired%E2%80%9D_notice\" >7. The campus or workplace \u201clicense expired\u201d notice<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#8_The_perfectly_written_one\" >8. The perfectly written one<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#A_five-place_checklist_for_any_suspicious_email\" >A five-place checklist for any suspicious email<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Do_funny_phishing_emails_exist\" >Do funny phishing emails exist?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#What_to_do_when_a_suspicious_email_arrives\" >What to do when a suspicious email arrives<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#What_to_do_if_you_already_clicked_or_replied\" >What to do if you already clicked or replied<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Our_perspective_you_cannot_out-read_every_phish\" >Our perspective: you cannot out-read every phish<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Protect_your_accounts_in_case_a_phish_gets_through\" >Protect your accounts in case a phish gets through<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Using_samples_to_train_your_team\" >Using samples to train your team<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#What_are_some_good_examples_of_phishing_emails\" >What are some good examples of phishing emails?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#What_is_the_most_common_trick_in_phishing_emails\" >What is the most common trick in phishing emails?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Can_a_phishing_email_have_no_spelling_mistakes\" >Can a phishing email have no spelling mistakes?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Should_I_forward_a_phishing_email_to_coworkers_as_a_warning\" >Should I forward a phishing email to coworkers as a warning?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#What_if_I_am_not_sure_whether_an_email_is_real\" >What if I am not sure whether an email is real?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/logmeonce.com\/resources\/samples-of-phishing-emails\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Most phishing emails fall into a few patterns: account alerts, payment problems, fake invoices, shipping notices, refund offers and urgent requests from a \u201cboss.\u201d<\/li>\n<li>Check the sender\u2019s real address, where the link actually goes, how the greeting reads and what pressure the message applies. Perfect spelling no longer proves an email is safe.<\/li>\n<li>Never click links or attachments in a suspicious message, including \u201cunsubscribe.\u201d Look up the company\u2019s contact details yourself and reach out directly.<\/li>\n<li>If you already shared a Social Security, card or bank number, go to IdentityTheft.gov. If you entered a password, change it at once and turn on multi-factor authentication.<\/li>\n<\/ul>\n<h2 id=\"what-a-phishing-email-looks-like\"><span class=\"ez-toc-section\" id=\"What_a_phishing_email_looks_like\"><\/span>What a phishing email looks like<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CISA says phishing messages may look like they come from a trusted organization and often use <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">urgent or emotionally appealing language, incorrect email addresses or links, or untrusted shortened URLs<\/a>. That is the whole genre in one sentence. The details change by brand and season, but the structure stays the same:<\/p>\n<ol>\n<li>A sender who appears to be known to you.<\/li>\n<li>A reason to act now.<\/li>\n<li>A link, attachment, phone number or reply request that moves you off the safe path.<\/li>\n<\/ol>\n<p>The Federal Trade Commission lists the most common stories: <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">suspicious activity or login attempts, account or payment problems, requests to confirm personal or financial information, unrecognized invoices, and fake government refunds<\/a>. Every sample below is a variation on one of those.<\/p>\n<h2 id=\"eight-sample-phishing-emails-with-red-flags\"><span class=\"ez-toc-section\" id=\"Eight_sample_phishing_emails_with_red_flags\"><\/span>Eight sample phishing emails, with red flags<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"1-the-suspicious-sign-in-alert\"><span class=\"ez-toc-section\" id=\"1_The_%E2%80%9Csuspicious_sign-in%E2%80%9D_alert\"><\/span>1. The \u201csuspicious sign-in\u201d alert<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> Microsoft Account Team <a href=\"mailto:security-alert@micros0ft-support.example\">security-alert@micros0ft-support.example<\/a><br \/>\n<strong>Subject:<\/strong> Unusual sign-in activity on your account<\/p>\n<p>Dear user, we detected a sign-in from a new device in another country. If this was not you, verify your account within 24 hours or access will be suspended.<\/p>\n<p>[Verify my account]<\/p>\n<\/blockquote>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>The domain swaps the letter \u201co\u201d for a zero. Government guidance on real examples points to <a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/real-examples-fake-emails\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">spoofed addresses with subtle character substitutions<\/a>.<\/li>\n<li>\u201cDear user\u201d means the sender does not know your name.<\/li>\n<li>A 24-hour deadline with a threat of suspension is manufactured urgency.<\/li>\n<li>The button hides its destination. Hover over it before doing anything else, and treat any mismatch as a stop sign.<\/li>\n<\/ul>\n<p><strong>Safe move:<\/strong> Do not use the button. Open a new browser tab, type the service\u2019s address yourself, and check your account\u2019s security page.<\/p>\n<h3 id=\"2-the-payment-problem\"><span class=\"ez-toc-section\" id=\"2_The_payment_problem\"><\/span>2. The payment problem<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> Billing <a href=\"mailto:billing@streaming-service-help.example\">billing@streaming-service-help.example<\/a><br \/>\n<strong>Subject:<\/strong> Your payment was declined, update now<\/p>\n<p>Hi jane.doe@yourmail.com, we could not process your monthly payment. Update your card details to avoid losing access.<\/p>\n<\/blockquote>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>The greeting uses your email address instead of your name, a pattern Canada\u2019s cyber safety agency lists among <a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/real-examples-fake-emails\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">typical examples<\/a>.<\/li>\n<li>The sender domain is a generic \u201chelp\u201d site, not the company\u2019s own domain.<\/li>\n<li>The message wants card details through an email link.<\/li>\n<\/ul>\n<p><strong>Safe move:<\/strong> The same agency\u2019s advice is to go straight to the source, for example by <a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/real-examples-fake-emails\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">calling the number on the company\u2019s official website<\/a> rather than relying on links in the email.<\/p>\n<h3 id=\"3-the-unexpected-invoice\"><span class=\"ez-toc-section\" id=\"3_The_unexpected_invoice\"><\/span>3. The unexpected invoice<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> Accounts Receivable <a href=\"mailto:ar@vendor-invoices.example\">ar@vendor-invoices.example<\/a><br \/>\n<strong>Subject:<\/strong> Invoice 48213 overdue, see attached<\/p>\n<p>Please find the attached invoice for services rendered. Payment is now 15 days late. Open the attachment for details.<\/p>\n<\/blockquote>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>You do not recognize the vendor or the purchase. \u201cUnrecognized invoices\u201d are on the FTC\u2019s list of <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">common phishing stories<\/a>.<\/li>\n<li>The email says almost nothing and pushes you to open the attachment.<\/li>\n<li>A late-payment claim creates guilt and urgency together.<\/li>\n<\/ul>\n<p><strong>Safe move:<\/strong> Do not open the file. Check with your accounts payable team or the person who manages vendors. If you never ordered the service, report and delete the message.<\/p>\n<h3 id=\"4-the-shipping-notice\"><span class=\"ez-toc-section\" id=\"4_The_shipping_notice\"><\/span>4. The shipping notice<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> Delivery Notifications <a href=\"mailto:track@parcel-update.example\">track@parcel-update.example<\/a><br \/>\n<strong>Subject:<\/strong> Package on hold, address incomplete<\/p>\n<p>We could not deliver your parcel. Confirm your address and pay a $1.99 redelivery fee: bit.ly\/xxxxxx<\/p>\n<\/blockquote>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>A shortened link hides where you will land. CISA specifically names <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">untrusted shortened URLs<\/a> among the warning signs.<\/li>\n<li>A tiny fee is a hook: the goal is your card number, not $1.99.<\/li>\n<li>You may not be expecting a package at all.<\/li>\n<\/ul>\n<p><strong>Safe move:<\/strong> Open the carrier\u2019s app or type its address yourself, and enter the tracking number from a real order confirmation.<\/p>\n<h3 id=\"5-the-government-refund\"><span class=\"ez-toc-section\" id=\"5_The_government_refund\"><\/span>5. The government refund<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> Tax Refund Department <a href=\"mailto:refunds@gov-benefit-claims.example\">refunds@gov-benefit-claims.example<\/a><br \/>\n<strong>Subject:<\/strong> You are eligible for a refund of $842.16<\/p>\n<p>Click here to claim your refund. Provide your Social Security number and bank details to receive payment.<\/p>\n<\/blockquote>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>Fake government refunds appear on the FTC\u2019s list of <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">common phishing scams<\/a>.<\/li>\n<li>A real agency does not ask you to send a Social Security number by email.<\/li>\n<li>A \u201c.example\u201d lookalike domain instead of an official government address.<\/li>\n<\/ul>\n<p><strong>Safe move:<\/strong> Delete it. If you believe you might actually be owed money, go to the agency\u2019s official website on your own.<\/p>\n<h3 id=\"6-the-boss-who-needs-a-favor\"><span class=\"ez-toc-section\" id=\"6_The_boss_who_needs_a_favor\"><\/span>6. The boss who needs a favor<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> \u201cDana Whitfield, CEO\u201d <a href=\"mailto:dana.whitfield.ceo@mailbox-secure.example\">dana.whitfield.ceo@mailbox-secure.example<\/a><br \/>\n<strong>Subject:<\/strong> Quick task, are you at your desk?<\/p>\n<p>I\u2019m in a meeting and can\u2019t talk. I need you to process a wire transfer today. Keep this confidential. I\u2019ll send details.<\/p>\n<\/blockquote>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>The display name is a real executive but the address is a free or unrelated mailbox.<\/li>\n<li>Secrecy and speed are used to stop you from checking with anyone.<\/li>\n<li>It asks for money movement.<\/li>\n<\/ul>\n<p>Indiana University\u2019s phishing education pages describe spear phishing in just these terms: <a href=\"https:\/\/phishing.iu.edu\/stories\/index.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">impersonating a person of authority and urgently requesting a banking or wire transaction<\/a> so you act without thinking.<\/p>\n<p><strong>Safe move:<\/strong> Call or message the executive using a number you already have, not one from the email. Finance teams should require a second approver for any new wire request.<\/p>\n<h3 id=\"7-the-campus-or-workplace-license-expired-notice\"><span class=\"ez-toc-section\" id=\"7_The_campus_or_workplace_%E2%80%9Clicense_expired%E2%80%9D_notice\"><\/span>7. The campus or workplace \u201clicense expired\u201d notice<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> IT Helpdesk <a href=\"mailto:helpdesk@it-support-portal.example\">helpdesk@it-support-portal.example<\/a><br \/>\n<strong>Subject:<\/strong> [External] Your license has expired<\/p>\n<p>Your Office license has expired. Sign in below to renew, or your mailbox will be deactivated.<\/p>\n<\/blockquote>\n<p>University IT departments publish real examples of this kind of lure because it works. The University of Cincinnati keeps a <a href=\"https:\/\/www.uc.edu\/about\/ucit\/about\/cybersecurity\/phishing\/phish-bowl.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phish Bowl of real-life examples<\/a> reported by its community, and it is worth browsing the page for your own school or employer to see the exact styles aimed at you.<\/p>\n<p><strong>Red flags:<\/strong><\/p>\n<ul>\n<li>Real IT teams rarely threaten deactivation by email.<\/li>\n<li>The sign-in link leads to a page that looks like your login screen but sits on another domain.<\/li>\n<li>An \u201c[External]\u201d tag on a message claiming to be from inside your organization should make you slow down.<\/li>\n<\/ul>\n<p><strong>Safe move:<\/strong> Open your company\u2019s IT portal from a bookmark. If you have a reporting button or a security mailbox, use it.<\/p>\n<h3 id=\"8-the-perfectly-written-one\"><span class=\"ez-toc-section\" id=\"8_The_perfectly_written_one\"><\/span>8. The perfectly written one<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<blockquote>\n<p><strong>From:<\/strong> Customer Support <a href=\"mailto:support@secure-account-review.example\">support@secure-account-review.example<\/a><br \/>\n<strong>Subject:<\/strong> Action required on your recent order<\/p>\n<p>Thank you for your continued business. We have identified a discrepancy on your account and kindly ask that you review the enclosed document at your earliest convenience.<\/p>\n<\/blockquote>\n<p>There are no typos, no shouting and no threats, and that is the point. CISA notes that poor grammar used to be a common sign, but <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">in the era of AI some emails now have perfect grammar and spelling<\/a>. A calm tone is not proof of legitimacy.<\/p>\n<p><strong>Red flags:<\/strong> an unfamiliar sender domain, a vague \u201cdiscrepancy,\u201d and a document you did not ask for.<\/p>\n<h2 id=\"a-five-place-checklist-for-any-suspicious-email\"><span class=\"ez-toc-section\" id=\"A_five-place_checklist_for_any_suspicious_email\"><\/span>A five-place checklist for any suspicious email<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>When a message makes you hesitate, check these in order:<\/p>\n<ol>\n<li><strong>The sender address.<\/strong> Look past the display name at the actual address and domain. Watch for swapped letters, extra words and unrelated domains.<\/li>\n<li><strong>The greeting.<\/strong> \u201cDear customer\u201d or your email address in place of your name is a weak signal on its own, but a useful one.<\/li>\n<li><strong>The link.<\/strong> Hover without clicking. Does the destination match the company? Shortened links deserve extra suspicion.<\/li>\n<li><strong>The ask.<\/strong> Logins, payments, gift cards, codes, wire transfers and \u201cconfirm your details\u201d are the usual goals.<\/li>\n<li><strong>The pressure.<\/strong> Deadlines, threats, secrecy and too-good-to-be-true offers are tools to stop you from thinking.<\/li>\n<\/ol>\n<p>Canada\u2019s Get Cyber Safe publishes a <a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/what-do-about-suspicious-looking-message\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">flow chart for suspicious messages<\/a> that walks through the same questions: sender\u2019s address, spelling or blurry logos, urgency or threats, and odd requests. And because phishing is among the most common cybercrimes, NIST tells users to take <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">a second, or third, look<\/a> at any message asking them to click a link or transfer funds.<\/p>\n<h2 id=\"do-funny-phishing-emails-exist\"><span class=\"ez-toc-section\" id=\"Do_funny_phishing_emails_exist\"><\/span>Do funny phishing emails exist?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>People search for \u201cfunny\u201d phishing emails because many scam messages are clumsy: absurd inheritance stories, mangled English, a prince with a very specific tax problem. Some of those are comic, and some are deliberately crude to filter out skeptical readers so scammers only spend time on the most trusting ones.<\/p>\n<p>The trap is assuming that a silly message is harmless. Clicking a link in a funny email is as risky as clicking one in a serious one, and a tool that tracks clicks or loads remote content works the same either way. If you want to share an example with coworkers, send a screenshot and not the live message. Do not forward the original with its links active.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1792933326073_Do-funny-phishing-emails-exist-overview-diagram.jpeg\" alt=\"Do funny phishing emails exist? \u2014 overview diagram\" title=\"\"><\/p>\n<h2 id=\"what-to-do-when-a-suspicious-email-arrives\"><span class=\"ez-toc-section\" id=\"What_to_do_when_a_suspicious_email_arrives\"><\/span>What to do when a suspicious email arrives<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CISA\u2019s guidance is short: if a message is suspicious, <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">do not click links or attachments, report it and delete it<\/a>. If it might be real, look up verified contact information and contact the company or person directly.<\/p>\n<p>Two details people miss:<\/p>\n<ul>\n<li><strong>Do not reply.<\/strong> Replying confirms your address is active.<\/li>\n<li><strong>Do not click \u201cunsubscribe.\u201d<\/strong> CISA says to delete fraudulent messages <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">without clicking any link or attachment, including links labeled unsubscribe<\/a>.<\/li>\n<\/ul>\n<p>At work, report first using your security team\u2019s process. At home, use your email provider\u2019s report-phishing option, then delete.<\/p>\n<h2 id=\"what-to-do-if-you-already-clicked-or-replied\"><span class=\"ez-toc-section\" id=\"What_to_do_if_you_already_clicked_or_replied\"><\/span>What to do if you already clicked or replied<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Stay calm and act in the right order. What you do depends on what you gave away.<\/p>\n<p><strong>You only clicked a link.<\/strong> Close the page. Do not enter anything. Run a security scan on your device and watch your accounts for odd activity.<\/p>\n<p><strong>You typed a password.<\/strong> Change it right away on the real site, and on any other site where you reused it. Turn on multi-factor authentication. If this is a work account, tell your IT team immediately so they can check for forwarding rules and unusual sessions.<\/p>\n<p><strong>You shared a Social Security, credit card or bank account number.<\/strong> The FTC says to go to <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">IdentityTheft.gov for steps based on the information you lost<\/a>. Call your bank or card issuer using the number on the back of your card.<\/p>\n<p><strong>You opened an attachment.<\/strong> Disconnect from the network if you can, and contact IT or a trusted technician before doing anything else.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1792933279946_First-responses-for-four-phishing-exposure-scenarios.jpeg\" alt=\"First responses for four phishing exposure scenarios\" title=\"\"><\/p>\n<p>If a password may have leaked, our guides on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/what-should-you-do-after-a-password-breach\" target=\"_blank\" rel=\"noopener\">what to do after a password breach<\/a> and <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/sos-what-to-do-after-a-data-breach\" target=\"_blank\" rel=\"noopener\">what to do after a data breach<\/a> cover the follow-up steps in order.<\/p>\n<h2 id=\"our-perspective-you-cannot-out-read-every-phish\"><span class=\"ez-toc-section\" id=\"Our_perspective_you_cannot_out-read_every_phish\"><\/span>Our perspective: you cannot out-read every phish<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>We build password and identity security tools, and we see the same pattern in the way people get caught. It is rarely carelessness. It is a busy person at 4:45 p.m. facing a message that looks routine. Training helps, but expecting a human to spot every well-made fake is a losing plan, particularly now that spelling is no longer a tell.<\/p>\n<p>The better approach is to make a mistake survivable. Three habits do most of the work:<\/p>\n<ul>\n<li><strong>Use a unique password for every account.<\/strong> A phished password then opens one door, not twenty. A password manager makes that practical. See why <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/what-is-password-management-and-why-is-it-important\" target=\"_blank\" rel=\"noopener\">password management matters<\/a>.<\/li>\n<li><strong>Let the tool check the address for you.<\/strong> A password manager that autofills only on the saved site will not fill a fake login page, which is a quiet alarm in itself. Spend a minute on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/how-secure-are-password-manager-tools\" target=\"_blank\" rel=\"noopener\">how secure password managers are<\/a> if you are weighing the idea.<\/li>\n<li><strong>Add a second factor, ideally one that does not depend on typing a code.<\/strong> Passwordless and biometric options remove the secret a phisher is trying to collect.<\/li>\n<\/ul>\n<p>None of this replaces judgment. Slow down, verify through a second channel, and report what you see so the next person is not caught.<\/p>\n<blockquote>\n<p><em>\u2014 Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"protect-your-accounts-in-case-a-phish-gets-through\"><span class=\"ez-toc-section\" id=\"Protect_your_accounts_in_case_a_phish_gets_through\"><\/span>Protect your accounts in case a phish gets through<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you want a safety net behind your own caution, LogMeOnce offers a <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">password manager with plans for individuals and families<\/a>: Premium is $0.00 per month, Professional is $2.50 per month and Family is $4.99 per month. For monitoring, <a href=\"https:\/\/logmeonce.com\/pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">Dark Web Monitoring<\/a> is $1.67 per month, and you can run a free <a href=\"https:\/\/logmeonce.com\/dark-web-email-scan\" target=\"_blank\" rel=\"noopener\">dark web email scan<\/a> to see whether your address has appeared in known leaks. Teams can look at <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business plans<\/a>, where Teams is $4.00 per user per month and Business is $7.99 per user per month.<\/p>\n<h2 id=\"using-samples-to-train-your-team\"><span class=\"ez-toc-section\" id=\"Using_samples_to_train_your_team\"><\/span>Using samples to train your team<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you run security awareness at a small business or school, examples are your best material, with a few rules:<\/p>\n<ul>\n<li><strong>Use current, local examples.<\/strong> Universities such as Cincinnati publish what is hitting their campus. Your own reported emails are better still.<\/li>\n<li><strong>Mix categories.<\/strong> Include a payment alert, a document share, a boss request and one email that is real, so people learn to verify and not just to distrust everything.<\/li>\n<li><strong>Teach the action, not just the signs.<\/strong> The sample should end with a question: what would you do next? Indiana University\u2019s pages use <a href=\"https:\/\/phishing.iu.edu\/stories\/index.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">scenario questions<\/a> about clues, outcomes and next steps for this reason.<\/li>\n<li><strong>Make reporting easy and blame-free.<\/strong> People who fear punishment hide mistakes, and the first hour after a click is when speed matters most.<\/li>\n<\/ul>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"what-are-some-good-examples-of-phishing-emails\"><span class=\"ez-toc-section\" id=\"What_are_some_good_examples_of_phishing_emails\"><\/span>What are some good examples of phishing emails?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The classics are fake account alerts, declined-payment notices, unrecognized invoices, shipping problems and government refund offers. The FTC lists <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">these themes as the usual stories<\/a>. The eight samples above show each one with its red flags.<\/p>\n<h3 id=\"what-is-the-most-common-trick-in-phishing-emails\"><span class=\"ez-toc-section\" id=\"What_is_the_most_common_trick_in_phishing_emails\"><\/span>What is the most common trick in phishing emails?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Urgency combined with impersonation. The email claims to come from a company or person you trust and tells you something bad will happen unless you act now. Slowing down and verifying through a separate channel defeats most of it.<\/p>\n<h3 id=\"can-a-phishing-email-have-no-spelling-mistakes\"><span class=\"ez-toc-section\" id=\"Can_a_phishing_email_have_no_spelling_mistakes\"><\/span>Can a phishing email have no spelling mistakes?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. CISA notes that <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">AI-era phishing can have perfect grammar and spelling<\/a>. Judge the sender\u2019s domain, the link destination and what the message asks you to do, not how polished it reads.<\/p>\n<h3 id=\"should-i-forward-a-phishing-email-to-coworkers-as-a-warning\"><span class=\"ez-toc-section\" id=\"Should_I_forward_a_phishing_email_to_coworkers_as_a_warning\"><\/span>Should I forward a phishing email to coworkers as a warning?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Not as the original message. Use your company\u2019s reporting button or security mailbox, or send a screenshot with the links removed. Forwarding the live email risks someone clicking it.<\/p>\n<h3 id=\"what-if-i-am-not-sure-whether-an-email-is-real\"><span class=\"ez-toc-section\" id=\"What_if_I_am_not_sure_whether_an_email_is_real\"><\/span>What if I am not sure whether an email is real?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Do not use anything in the message. Find the company\u2019s phone number or website yourself and ask them directly. A legitimate organization will not mind the check.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">How To Recognize and Avoid Phishing Scams, FTC Consumer Advice<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Recognize and Report Phishing, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/real-examples-fake-emails\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Real examples of fake emails, Get Cyber Safe<\/a><\/li>\n<li><a href=\"https:\/\/www.getcybersafe.gc.ca\/en\/resources\/what-do-about-suspicious-looking-message\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">What to do about a suspicious-looking message, Get Cyber Safe<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing, NIST<\/a><\/li>\n<li><a href=\"https:\/\/phishing.iu.edu\/stories\/index.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Stories and examples, Phishing Education and Training, Indiana University<\/a><\/li>\n<li><a href=\"https:\/\/www.uc.edu\/about\/ucit\/about\/cybersecurity\/phishing\/phish-bowl.html\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phish Bowl, University of Cincinnati<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>See eight sample phishing emails, from fake invoices to CEO requests, with the red flags in each and what to do if you already clicked or replied.<\/p>\n","protected":false},"author":0,"featured_media":248445,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248443"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248443\/revisions"}],"predecessor-version":[{"id":248444,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248443\/revisions\/248444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248445"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}