Phishing email examples, red flags marked

Phishing email examples built on the emails office workers click most in tests, with each red flag marked in pen. Every time you cast a line, the phisher on the pier reels in another email. Further down you'll find one phish of each kind, then real company mail that looks worse.

Agreement between you and 4 other parties

A file nobody shared, behind our sign-in.

Bait

Phishing email examples

One example of each kind of phish, as it would land in a work inbox. Each red flag is underlined and numbered, and the list under the email says what each one is.

A file shared with you

A document, spreadsheet or scan someone shared, behind a sign-in page that only looks like your company's. The most-clicked test phish of late 2025 was a shared document named after the company's own IT help desk.

Subject: Document shared with you: Example Inc. IT Help Desk Info
From: Docs [email protected]
To: [email protected]

IT Help Desk shared a document with you.

Example Inc. IT Help Desk Info

Open: https://docs-example.example.net/d/it-help

Red flags

docs-example.example.netLookalike domain
https://docs-example.example.net/d/it-helpWrong destination
Sign in with your work account to viewLogin request

Company files live on files.example.com and open without a second sign-in. This one wants your password at the door.

A chat app saying someone needs you

An email that claims to come from the work chat app: your manager is trying to reach you, or you were added to a team. Chat notices took two places in the late 2025 top ten of test subjects.

Subject: Your manager is trying to reach you
From: Chat [email protected]
To: [email protected]

You have missed messages from your manager.

Latest: Are you free, need you on something before 3

Reply in chat: https://chat-notify.example.net/msg/4471

You are getting this email because your status is Away.

Red flags

need you on something before 3Urgency
https://chat-notify.example.net/msg/4471Wrong destination

Your manager does not wait for email to find you. The chat app lives on chat.example.com, and this notice comes from example.net.

Show 10 moreShow fewer

An HR policy to read and sign

A new dress code, vacation rule or conduct policy, with a deadline to acknowledge it. Half of the late 2025 top ten came from HR.

Subject: HR: Updated Dress Code Policy, effective Monday
From: HR Department [email protected]
To: [email protected]

Hi Sam,

Our dress code has been updated for all staff, including video calls.

Read and acknowledge it by Friday: https://example-hr.example.net/policy/dress

Red flags

example-hr.example.netLookalike domain
Sign in with your work account to acknowledgeLogin request

Policies live on the intranet, which never asks you to sign in again. The address puts example first and still ends in example.net.

Pay, benefits and rewards

A reimbursement, a bonus, a review or open enrollment ending today. Money, benefits or time off featured in about a sixth of the most-clicked test links of late 2025.

Subject: HR: Reimbursement approved, confirm your payment details
From: Expense Reimbursements [email protected]
To: [email protected]

Hi Sam,

Your reimbursement of $284.16 has been approved.

Confirm your bank details so it can be paid this week: https://example-expenses.example.net/pay

Red flags

example-expenses.example.netLookalike domain
Confirm your bank detailsPersonal data

Reimbursements arrive with your salary, in the account payroll already has. You also never claimed $284.16 of anything.

Training you have not done

A reminder that your training is past due, with a threat to your access. Training past due and assigned training both made the late 2025 top ten, and real reminders read the same.

Subject: HR: Training Past Due, final notice
From: Learning Team [email protected]
To: [email protected]

Hi Sam,

Your required security training is 9 days past due.

Complete it today to keep your system access: https://example-training.example.org/course

Red flags

example-training.example.orgLookalike domain
to keep your system accessThreat

Overdue training is the most believable email in any inbox, which is why phishing tests copy it. This course lives on example.org, not on the company's learning site.

An IT warning about your account

Your mailbox is full, your settings changed, your internet use was flagged, or a license is waiting. The fix is always a sign-in page or an attachment.

Subject: IT: Internet usage report for your account
From: IT Department [email protected]
To: [email protected]

Attachment: Internet_Usage_Report.html

Hi Sam,

Our web filter flagged unusual browsing on your account this month.

Review the attached report and sign in to dispute any entries.

Red flags

example-it.example.netLookalike domain
Internet_Usage_Report.htmlRisky attachment
sign in to dispute any entriesLogin request

Nobody wants a list of their browsing, which is why it gets opened. The report is a web page in disguise, and IT's real address ends in example.com.

A meeting that already started

A meeting that is live without you, a seat to reserve, or a project invite that expires. The hurry is the whole trick.

Subject: The Strategy Meeting is LIVE. Please Enter
From: Video Meetings [email protected]
To: [email protected]

The Q4 strategy meeting has started and the host is waiting for you.

Join now: https://video-join.example.net/j/q4-strategy

Red flags

the host is waiting for youUrgency
https://video-join.example.net/j/q4-strategyWrong destination
Sign in with your work account to joinLogin request

A meeting you were never invited to, already started, with a host waiting. Real invites sit in your calendar, and nobody waits for anyone.

A package that needs a fee

A delivery held at customs or missed at your desk, released for a small fee or your date of birth.

Subject: Import Duty/Tax Payment Needed
From: Customs Clearance [email protected]
To: [email protected]

Your international package is held at customs.

Pay the $6.95 import duty within 48 hours or the package will be destroyed.

Pay duty: https://customs-fees.example.org/pay

Red flags

Your international package is held at customs.Out of the blue
within 48 hoursUrgency
the package will be destroyedThreat

You ordered nothing from abroad. The 48 hours are there so you pay before you remember that.

An invoice to pay

An invoice or a payment problem, often sent as a web page: about a quarter of the attachments opened in late 2025 tests were HTML files.

Subject: Invoice Payment Process
From: Accounts Receivable [email protected]
To: [email protected]

Attachment: INV-2026-1187.html

Hello,

Please process the attached invoice before the end of the month.

Open the file and sign in to view the amount due.

Red flags

INV-2026-1187.htmlRisky attachment
Please process the attached invoiceSurprise invoice
sign in to view the amount dueLogin request

An invoice is a PDF or a line in the finance system, never a web page with a sign-in box. Real suppliers also say which supplier they are.

A favor from the boss

A senior name in a hurry: gift cards for a client, a quiet payment, your cell number. Only scammers ask to be paid in gift cards.

Subject: Quick favor, keep it between us
From: Office of the CEO [email protected]
To: [email protected]

Hi Sam,

I need 10 coffee shop gift cards for a client today.

Buy them, scratch off the backs and email me the codes.

I am in meetings all day, so no calls please.

Red flags

webmail.example.netOdd sender
10 coffee shop gift cardsGift cards
scratch off the backs and email me the codesStrange request

The CEO has an assistant and a company card. Neither of them is you.

Payroll and bank changes

Payroll or a supplier changing where money goes. In a 2025 campaign against university staff, an HR compensation update led to a sign-in page, and the attackers then moved salaries to their own accounts.

Subject: 2026 Compensation and Benefits Update
From: HR Department [email protected]
To: [email protected]

Hi Sam,

Your updated compensation statement has been shared with you.

View statement: https://example-compensation.example.net/doc/cs26

Red flags

example-compensation.example.netLookalike domain
Sign in with your work accountLogin request
confirm your direct deposit detailsPersonal data

A 2025 campaign used this subject on university staff, then changed where their pay went. Your pay stub lives in the HR portal and never needs your bank details again.

A request to read back the code your phone shows, or to tap Approve on prompts you never asked for. Anyone who asks for your code is a scammer.

Subject: Verify your account now
From: Information Security [email protected]
To: [email protected]

We saw a sign-in to your account from a new country.

To block it, reply with the 6-digit code we just sent to your phone.

Red flags

Information SecurityKnown name
a sign-in to your account from a new countryAccount problem
reply with the 6-digit codeCode request

The security team's mailbox was taken over, so the address was real. The code on your phone is the second check on your account, and sending it lets them in.

Real emails that look like phishing

Company mail breaks the same rules: a deadline, a threat, Dear Employee, a link to an outside vendor. These are real, and each one gives you a way to check it that the email doesn't control.

Security Awareness Training

Subject: ACTION REQUIRED: Mandatory phishing training overdue
From: Security Awareness Training [email protected]
To: [email protected]

Dear Employee,

Your mandatory phishing awareness training is overdue. Complete it within 48 hours or your account may be suspended.

Start here: https://s.example.net/phish101, or from the Training tile on the intranet.

Real mail, with red flags anyway

Dear EmployeeGeneric greeting
your account may be suspendedThreat
https://s.example.net/phish101Short link

Real, and it breaks three rules of the course it links to. It asks for nothing, and the Training tile on the intranet opens the same course without the short link.

IT Service Desk

Subject: Verify your password reset request
From: IT Service Desk [email protected]
To: [email protected]

Dear User,

We received a request to reset your password. If this was not you, your account may be at risk.

Verify your request within 24 hours: https://login.example.com/verify

Real mail, with red flags anyway

Dear UserGeneric greeting
your account may be at riskAccount problem
within 24 hoursUrgency

Real. IT wrote Dear User, a scare and a deadline. The link stays on login.example.com, the page you sign in on every morning.

Show 2 moreShow fewer

Payroll

Subject: IMPORTANT: Payroll is migrating to a new portal
From: Payroll [email protected]
To: [email protected]

Dear Employee,

Payroll is migrating to a new portal. Log in by Friday or your pay stubs will not be available.

New portal: https://paydesk.example.org, with the Company sign-in button.

The move is announced on the Payroll page of the intranet.

Real mail, with red flags anyway

Dear EmployeeGeneric greeting
your pay stubs will not be availableThreat
https://paydesk.example.orgWrong destination

Real. Payroll picked a vendor on example.org, wrote Dear Employee and set a deadline. The Company sign-in button sends you to your own login page, and the intranet says the same.

Office of the CEO

Subject: URGENT: Your voice matters, survey closes in 24 hours
From: Office of the CEO [email protected]
To: [email protected]

Dear Team Member,

As I said at Monday's all-hands, I want to hear from every one of you.

Take the survey before it closes: https://s.example.net/ceo-pulse

It is anonymous, and the link is pinned in the staff channel too.

Real mail, with red flags anyway

survey closes in 24 hoursUrgency
Dear Team MemberGeneric greeting
https://s.example.net/ceo-pulseShort link

Real. The CEO's office sent the whole company a short link on a 24-hour clock, then asked why phishing tests go so badly. It asks for no sign-in, and the staff channel has the same link.

The red flags, explained

Every red flag on this page, from US and UK government security guidance.

Urgency: It gives you minutes or hours to act, so you react before you think.
Threat: It warns of something bad, like a locked account or lost pay, if you do not respond at once.
Emotion: It tries to make you scared, excited or curious enough to click first.
Too good: It offers a prize, a bonus or free money you never asked for.
Generic greeting: It opens with Dear user or Dear customer instead of your name, because it went to thousands of people.
Odd sender: The address is on a free public mail service, or is a jumble that means nothing.
Lookalike domain: The address or link is a near miss of the real domain, with a letter or an ending changed.
Wrong destination: The link goes to a site that does not match the company or the thing it claims to open.
Short link: A shortened link hides where it goes until you have clicked it.
Risky attachment: It carries a dangerous file type, sometimes hidden inside a zip file, that can infect your computer when opened.
Login request: It wants your password, or sends you from the email to a sign-in page that passes it to someone else.
Code request: It asks for a verification code, and anyone who asks for one is a scammer.
Approve prompts: It asks you to approve sign-in prompts you did not start, which is how a stolen password gets past the second check.
Personal data: It asks for card numbers, bank details, an ID number or a date of birth by email.
Bank change: It says the bank account for a payment has changed and asks you to use the new one.
Gift cards: It asks you to buy gift cards and send the codes, a payment no real business asks for.
Strange request: It asks for something odd, or out of character for the person it claims to be from.
Surprise invoice: It carries an invoice or an overdue bill you do not recognize.
Account problem: It says something is wrong with your account and pushes you to act.
QR code: It asks you to scan a QR code, which hides the link from some mail filters and moves you to your phone.
Known name: It comes from a name you trust, sometimes from a real colleague's account that was taken over.
Bad spelling: It has poor spelling and grammar while claiming to come from a careful, official sender.
Out of the blue: You were not expecting the email, and you do not recognize the address it came from.

Why these phishing emails work

They look like your own company

The ten subject lines clicked most in late 2025 tests all named something inside the company. The top two carried the company’s own name. Of the 20 links clicked most, nearly nine in ten faked a real domain.

The examples above look like any Tuesday in a work inbox, down to a gentle reminder that your training is overdue.

PDFs, Word files and web pages

An HTML file opens in your browser as a web page. That’s how a fake sign-in box can arrive as an attachment.

The 20 attachments opened most in late 2025 tests	Share
PDFs	About half
Word files	A quarter
HTML files	A quarter

The QR code moves you to your phone

A QR code can slip past some mail filters, and it moves you onto a phone your employer may not protect. The codes scanned most in 2025 tests were about IT and HR. In one three-month round of tests, the top code promised a new drug and alcohol policy.

How to spot a phishing email

Checks that work on any inbox

These checks work whatever the email looks like:

Read every address and link from the right. A link to files.example.com.share-view.example.net goes to example.net.
Ask what it wants from you. Giving away a password or the code on your phone can cost money. So can buying gift cards or switching to new bank details.
Check with the sender through a channel you already know. Don’t use the link, phone number or reply address in the email.
Treat a deadline as a reason to slow down, even one that says EOD.
Confirm new bank details by phone, on the number already on file.
Don’t judge an email by how it looks. Real company mail makes the same threats, and an FYA label asks for action just as a phish does.

What to do with a phishing email

Don’t click anything or reply. Use the Report phishing button instead. If you already clicked, tell IT and reset your password.

Outside work, people in the UK can forward a scam email to [email protected], the National Cyber Security Centre’s reporting address. In Australia, the government’s advice is to delete it and report it to Scamwatch. The Phish or IT phishing game gives you five emails a day to practice on. In the game, your own company’s mail looks worse than the phish.

Our other work email examples help with the emails you’d rather write.

Questions about phishing emails

What are examples of phishing emails?

The ones clicked most look like internal mail: a shared document, a new HR policy, a reimbursement, overdue training, or a chat notice saying your manager wants you. Older ones ask for gift cards, a package fee or the code on your phone.

What are the red flags of a phishing email?

The big ones are a sign-in page that isn't your company's and an address or link that nearly matches the real one. Any request for a code, gift cards or bank details is another. Urgency, threats and Dear Employee count too, though real company mail uses them as well.

How do I report a phishing email?

Use the report button in your mail app, or your company's own button so IT sees it too. In Outlook that's Report, then Report phishing, and Gmail keeps Report phishing under More. In the UK you can also forward it to [email protected], and in Australia report it to Scamwatch.

What should I do if I clicked a phishing link at work?

Tell your IT team right away so they can lock the account, then change any password you typed on the page. A good security team will thank you, because people who fear the blame report late, or not at all.

What are the main types of phishing emails?

Mass phishing, spear phishing, whaling and business email compromise. Mass phishing goes to millions of inboxes at once, spear phishing uses details about one company or person, and whaling is spear phishing aimed at someone senior. Business email compromise takes over a real business or personal email account to make unauthorized money transfers.

What happens if you open a phishing email?

The email's job is to get you to the next step: clicking a link to a site that installs a virus or takes your password. If you only read it, report it and delete it.

Sources

The 20 sources behind this page

Phishing email examples, red flags marked

Phishing email examples

A file shared with you

A chat app saying someone needs you

An HR policy to read and sign

Pay, benefits and rewards

Training you have not done

An IT warning about your account

A meeting that already started

A package that needs a fee

An invoice to pay

A favor from the boss

Payroll and bank changes

A sign-in code or prompt

Real emails that look like phishing

Security Awareness Training

IT Service Desk

Payroll

Office of the CEO

The red flags, explained

Why these phishing emails work

They look like your own company

PDFs, Word files and web pages

The QR code moves you to your phone

How to spot a phishing email

Checks that work on any inbox

What to do with a phishing email

Questions about phishing emails

Sources