Phishing emails are designed to trick you into clicking a link, opening an attachment, sharing confidential information, or sending money. They may pretend to come from your bank, a delivery company, your employer, a cloud storage provider, or even someone you know.
The problem is that modern phishing emails can look convincing. They may use company logos, professional language, and personal details. Some are full of spelling mistakes, but others are carefully written and difficult to distinguish from legitimate messages.
This guide explains how to spot phishing emails through 10 realistic examples, identifies the warning signs in each message, and shows you what to do if you receive or accidentally interact with one.
10 Warning Signs of a Phishing Email
Remember: One warning sign does not prove a message is fraudulent, and a professional-looking email is not proof that it is legitimate. Verify suspicious requests through a separate, trusted channel.
10 Realistic Phishing Email Examples
The following examples are fictional teaching samples based on common phishing tactics. Names, sender addresses, and domains are illustrative. Any domain ending in .example is used as a placeholder here, not as a genuine service website.
Example 1: The Fake Bank Security Alert
Account scare Urgent linkWe detected suspicious activity on your bank account. For your protection, access will be suspended in 30 minutes unless you verify your identity immediately.
Verify your account now
Failure to complete verification may result in permanent account restrictions.
Security Department
Why this email is suspicious
- It creates panic: The short deadline pressures you to act before thinking.
- The sender domain is unverified: A bank’s name in the display field does not establish that the message came from the bank.
- It pushes you toward a link: The link may lead to a counterfeit login page designed to steal credentials.
- The greeting is generic: This can be a clue, although legitimate automated messages may also use generic greetings.
Example 2: The Fake Microsoft or Google Login Alert
Credential theft ImpersonationWe noticed a sign-in attempt from a new device. To prevent unauthorized access, please confirm your password and security code.
Your account may be restricted if verification is not completed.
Review Sign-in Activity
Red flags to look for
- The sender’s actual email address does not match the provider’s verified domain.
- The message asks you to enter a password or verification code through its link.
- It provides little verifiable information about the event.
- The link may display familiar branding while leading to a different domain.
Important: Real security notifications do exist. Do not dismiss every alert automatically; verify it independently instead of using the message’s link.
Example 3: The Fake Delivery Fee or Missed Package
Small payment request Personal informationPay the outstanding fee to reschedule delivery. Your package may be returned to the sender if payment is not received within 24 hours.
Confirm Delivery Details
Why scammers use this trick
People frequently order products online, so an unexpected delivery notification can seem believable. A small fee may appear harmless, but the payment page can be designed to steal card details or other personal information.
- You were not expecting a parcel.
- The tracking number is missing or does not match your order.
- The sender’s domain is not the courier’s official domain.
- The email asks for payment through an unfamiliar link.
Example 4: The Fake Invoice or Payment Reminder
Unexpected attachment Payment fraudOur records show that invoice INV-80421 remains unpaid. Please review the attached document and arrange payment today to avoid additional charges.
If you have already paid, disregard this reminder.
How to identify the scam
- You do not recognize the supplier or invoice.
- The message uses pressure to rush payment.
- The attachment has an unexpected or suspicious file type.
- The sender’s email differs from the vendor’s established contact address.
- Payment instructions differ from those previously agreed.
Some malicious attachments attempt to install malware, while others direct recipients to counterfeit payment pages. A PDF or Word document is not automatically dangerous, but unexpected files should be treated carefully.
Example 5: The Fake Boss Asking for Money or Gift Cards
Business email compromise Authority pressurePlease purchase several gift cards and send me the codes. Keep this confidential for now. I’ll explain everything later.
Let me know as soon as it’s done.
Warning signs
- The request is unusual for the supposed sender.
- It demands secrecy and immediate action.
- It asks for gift card codes, a wire transfer, or another difficult-to-reverse payment.
- The sender’s address or communication channel is unfamiliar.
Attackers can impersonate executives or compromise genuine email accounts. A message appearing in a familiar conversation is not enough to prove the request is legitimate.
Example 6: The Fake Document-Sharing Notification
Fake login page Workplace targetingFile: Quarterly Budget Review
Shared by: Project Administration
Sign in to view the document.
How to spot the deception
- You were not expecting the document.
- The supposed colleague or project name is vague.
- The sender domain is not the organization’s actual document-sharing service.
- The link requests your work account password on an unfamiliar page.
Fake notifications may imitate Microsoft 365, Google Drive, Dropbox, or other collaboration tools. The logo and layout alone cannot establish authenticity.
Example 7: The Fake Refund, Prize, or Gift Card
Too-good-to-be-true offer Data collectionComplete a short verification form to claim your gift card. A small processing charge may apply.
Claim Your Reward
Why it is suspicious
- You did not enter a contest or request a refund.
- The offer asks for personal details or payment before delivering the reward.
- The sender cannot be independently verified.
- The message uses excitement and a deadline to discourage careful checking.
Example 8: The Fake Cloud Storage Warning
Account suspension threat Credential theftTo prevent loss of access to your files, confirm your billing information and sign in to renew your subscription.
Update Subscription
Look for these red flags
- The email uses a threat involving access to important files.
- The sender’s domain does not match the provider’s official domain.
- The message requests login or payment details through a link.
- The billing issue cannot be confirmed in your actual account.
Real services can send billing reminders, so check the subscription status directly rather than assuming either way.
Example 9: The Fake Password Reset or MFA Verification Request
Authentication theft Unexpected verificationIf you did not make this request, use the link below to cancel it and confirm your identity.
Review Request
Why this can be dangerous
The attacker may be trying to make you visit a fake login page or reveal a one-time verification code. In some attacks, a real password reset or sign-in attempt may have been initiated by someone else.
- You did not request a password reset.
- The message directs you to an unfamiliar domain.
- Someone asks you to disclose a one-time code or approve a login you did not initiate.
Example 10: The QR Code or “Scan to Verify” Email
QR-code phishing Hidden destinationScan the QR code in the attached notice using your phone and sign in to complete the process. Accounts that are not verified may lose access.
IT Support
Why QR codes can hide phishing attempts
A QR code can conceal a web address, making it harder to inspect the destination before opening it. Attackers may try to move the victim from a work computer to a phone, where the fake page may be harder to examine.
- You were not expecting an IT security exercise or verification request.
- The sender or domain is unfamiliar.
- The email asks you to scan a code and sign in urgently.
- The instructions bypass your organization’s normal IT process.
How to Identify a Phishing Email in 30 Seconds
Before opening a link or attachment, pause and check these six things.
| What to inspect | Possible warning sign | Safer response |
|---|---|---|
| Sender address | Lookalike domain, unexpected address, or unusual reply-to address | Compare it with a known, verified address |
| Request | Password, verification code, payment, or confidential information | Verify through the official service or a separate channel |
| Urgency | Threats, artificial deadlines, or pressure to keep secrets | Pause and check independently |
| Links | Unexpected destination or a domain that does not match the claimed service | Do not click; open the official website directly |
| Attachments | Unexpected invoice, archive, document, or executable | Confirm with the sender before opening |
| Context | You were not expecting the message or the request is unusual | Contact the person or organization using trusted details |
Interactive Quiz: Can You Spot the Phishing Email?
Test your knowledge with these three short scenarios. Choose the safest answer for each one.
1. You receive an email claiming your bank account will be locked in 15 minutes. What should you do?
2. Your manager emails you asking for gift card codes and says to keep it secret. What is the safest response?
3. An unexpected email asks you to scan a QR code and sign in to keep your work account active. What should you do?
What Should You Do If You Receive a Phishing Email?
- Do not click anything. Avoid links, attachments, QR codes, and unexpected unsubscribe buttons in suspicious messages.
- Do not reply. A response may confirm that your email address is active or invite further manipulation.
- Verify the message independently. Contact the supposed sender through an official website, known phone number, or trusted work channel.
- Report it. Use your email provider’s phishing-reporting feature. If it involves work, follow your organization’s security reporting process.
- Remove it after reporting. Delete the message once you have followed any relevant reporting or incident-response instructions.
What If You Already Clicked a Phishing Link?
Do not panic. Clicking a link does not automatically mean your account or device has been compromised. The right response depends on whether you only opened a page, downloaded a file, entered credentials, approved a login, or submitted payment information.
If you clicked the link but entered nothing
- Close the suspicious page.
- Do not download files, allow notifications, install software, or approve unexpected prompts.
- Update your browser and device software.
- If a file was downloaded or you suspect malware, run a scan using reputable, up-to-date security software and follow your organization’s IT guidance if applicable.
If you entered your password
- From a trusted device, open the real service website directly and change the affected password immediately.
- If you reused that password elsewhere, change it on every affected account.
- Enable multifactor authentication and review recovery details, active sessions, and recent sign-in activity.
- For a work account, notify your IT or security team promptly.
If you shared a verification code or approved an unexpected login
- Contact the service’s official support or security team immediately.
- Secure the account, revoke unfamiliar sessions, and review authentication methods.
- Change the password from a trusted device if the account uses one.
- Review email forwarding rules and account recovery settings if your email account may be affected.
If you entered payment or banking information
- Contact your bank or card issuer immediately using a verified number or its official app.
- Ask whether the card or account needs to be blocked, replaced, or monitored.
- Review recent transactions and report unauthorized activity as soon as possible.
- Save relevant evidence, such as the email, transaction details, and screenshots, without revisiting suspicious links.
How to Protect Yourself From Phishing Emails
Use unique passwords and a password manager
Reusing a password across multiple websites creates risk: if one service is compromised, attackers may try the same credentials elsewhere. A reputable password manager can generate and store unique passwords for your accounts.
Enable multifactor authentication or passkeys
Multifactor authentication adds another layer of protection beyond your password. Passkeys can also help resist phishing on supported services because they are tied to the legitimate site or app. Never share one-time codes or approve authentication prompts that you did not initiate.
Keep devices and software updated
Install security updates for your operating system, browser, and applications. Updates help address known vulnerabilities that could be exploited if you visit a malicious page or open a harmful file.
Use spam filters and report suspicious messages
Email providers filter many unwanted messages, but some will still reach your inbox. Report phishing using your provider’s built-in reporting feature instead of merely moving the message to another folder.
Verify unusual requests out of band
If a colleague asks for money, a password reset, sensitive documents, or an unusual change to payment details, confirm it using a separate trusted communication channel. Do not rely on the contact information provided in the suspicious email.
Be cautious with QR codes and attachments
A QR code is simply another way to direct you to a website. It does not make a link trustworthy. Treat unexpected files and QR-based sign-in requests with the same caution as ordinary links.
Frequently Asked Questions
What is the easiest way to recognize a phishing email?
Look for unexpected requests, suspicious sender addresses, unfamiliar link destinations, pressure to act quickly, and requests for passwords, verification codes, or payments. Verify the message independently before taking action.
Can a phishing email look completely legitimate?
Yes. Attackers can copy branding, use polished language, personalize messages, or compromise real accounts. Do not treat a logo, correct spelling, or familiar display name as proof of authenticity.
Is it safe to open an email without clicking its links?
Simply viewing a normal email is generally much less risky than following a malicious link or opening an attachment. Keep your email software updated, and avoid loading unexpected remote content or interacting with suspicious elements.
Should I reply to a suspicious email to ask whether it is real?
No. Do not reply to the suspicious message. Contact the person or organization using a separate, trusted channel, such as a known phone number or its official website.
Are phishing emails always sent from fake email addresses?
No. Attackers can spoof sender information or use compromised legitimate accounts. Examine the context and verify unusual requests even if the sender appears familiar.
Can antivirus software stop every phishing attack?
No. Security software and email filters can block some threats, but they cannot guarantee that every fraudulent message or website will be detected. Careful verification and strong account security remain important.
How do I report a phishing email?
Use your email provider’s Report phishing option, or follow your employer’s security reporting process. In the United States, phishing can also be reported to the Federal Trade Commission at ReportFraud.ftc.gov. In other countries, use the relevant national cybercrime or consumer-protection reporting channel.
What is the difference between phishing and spam?
Spam is unsolicited or unwanted messaging, which is not necessarily fraudulent. Phishing specifically attempts to deceive recipients into revealing information, sending money, granting access, or taking another action that benefits the attacker.
Final Thoughts: Stop, Check, and Verify
The most convincing phishing emails exploit familiar habits: checking a bank alert, receiving a parcel, reviewing an invoice, opening a shared document, or responding to a manager. The safest response is to slow down and verify unexpected requests before acting.
Check the actual sender address, question unexpected urgency, avoid unfamiliar links and attachments, and use official websites or trusted contact methods to confirm a message. Strong passwords, multifactor authentication, passkeys, and updated devices add further protection.
When in doubt, do not take the bait. Report the message, verify it independently, and remove it from your inbox.