Phishing email examples: 10 real patterns and how to spot them

Understanding phishing email examples in the modern office

Phishing remains the most common way for attackers to enter a business network. These phishing email examples show how attackers use psychological tricks to steal credentials or install malware. By learning these patterns, your team can become a strong line of defense. Most successful attacks rely on a person clicking a link or downloading a file without checking the source.

Attackers spend time researching their targets. They might know who your vendors are or which software you use. This makes their emails look more legitimate. However, almost every phishing message contains specific clues that reveal its true nature. These clues include mismatched URLs, unusual sender addresses, and strange requests for immediate action.

The goal of phishing is usually to gain a foothold. Once an attacker has one set of login credentials, they can move laterally through your network, accessing sensitive customer data, financial records, or internal communications. This initial email is the start of a much larger security incident that can take months to resolve and cause significant financial loss.

1. The urgent account suspension alert

This is one of the most frequent phishing email examples. You receive an email claiming your Microsoft 365 or Google Workspace account will be deleted in 24 hours due to a security violation. The goal is to make you panic. When people panic, they often forget to check the sender's email address. The message might claim that multiple failed login attempts were detected from an unusual location.

• The sender address looks like 'support@microsft-security.com' instead of 'microsoft.com'.
• The link leads to a login page that looks identical to the real one but has a different domain in the address bar.
• The email uses threatening language about losing access to all your files and communications.

2. The unpaid invoice lure

Accounting departments are often targeted with fake invoices. The email usually has a PDF or ZIP attachment. If you open the attachment, it may install ransomware or a credential stealer. The sender often impersonates a real vendor you have worked with in the past. They might say the payment is 'past due' and that services will be cut off if not paid today.

Attackers often use 'invoice number' or 'billing statement' in the subject line to grab attention. They know that finance teams deal with dozens of invoices a day and might click on one out of habit. A common sign of fraud is an invoice from a company you don't recognize or for a service your business doesn't use.

3. HR benefits and open enrollment updates

During benefit seasons, attackers send emails that look like they come from your HR department. They might ask you to 'update your payroll information' or 'review the new insurance plan.' Because employees expect these emails, they are less likely to be suspicious. The email might even use the company's logo to appear authentic.

These emails often link to a site that asks for your Social Security number or bank details. A real HR department will usually have you log in through a known employee portal rather than asking for sensitive data directly via an email link. Look for generic phrasing like 'All Staff' instead of your specific name.

4. The IT support password reset

You get an email stating that your password has expired or that a 'suspicious login' was detected from another country. It asks you to click a button to 'Secure your account' or 'Keep current password.' This button takes you to a fake portal that captures your current password as you type it. This is a classic credential harvesting attack.

Real IT departments rarely send password reset links unless you have requested one. If your company uses a Single Sign-On (SSO) system, a separate email for just one application is a major red flag. Always check the URL of the login page before typing anything.

5. Package delivery failure

With the rise of office ordering, emails from UPS, FedEx, or DHL are common. An attacker sends a notice saying a package could not be delivered and requires a 'redelivery fee' or a 'form update.' The link often leads to a site designed to steal credit card information. They may also include a malicious attachment labeled as a 'shipping label' or 'receipt.'

6. CEO fraud and urgent tasks

In this scenario, an employee receives a brief email that appears to be from the business owner or CEO. It might say, 'Are you at your desk? I need a quick favor.' Once the employee responds, the attacker asks them to purchase gift cards or wire money to a 'new vendor.' The attacker uses the executive's name and may even spoof their actual email address.

The goal is to bypass the normal financial controls of the business by using the authority of the CEO. They often claim they are in a meeting and cannot be reached by phone, which prevents the employee from verifying the request.

7. Shared document notifications

Attackers use services like SharePoint, OneDrive, or Dropbox to send real notifications that link to malicious files. Because the email comes from a legitimate service, it may bypass spam filters. The document itself might be a macro-enabled Word file that installs malware when opened. Always verify with the sender before opening a shared document you weren't expecting.

8. The 'Action Required' voicemail notification

Many businesses use email-to-voicemail services. Attackers send an email that looks like a voicemail notification from your office system. It includes a link to 'listen to the message.' Clicking the link takes you to a fake login page for your email account, claiming you need to sign in to access the recording.

9. The fake survey or contest win

Employees may receive an email offering a gift card or a prize for completing a 'company culture survey.' The link goes to a site that asks for their corporate login to verify their identity. This is another way attackers gather passwords from unsuspecting staff members.

10. The 'Legal Complaint' or subpoena

Attackers send emails that appear to be from a law firm or a government agency, claiming your business is being sued or is the subject of a complaint. They include a link to 'view the full complaint.' This tactic uses fear of legal trouble to force a quick, unthinking click.

How to verify a suspicious email

Verifying an email only takes a few seconds but can prevent a major security incident. Encourage your team to follow these steps for every message that asks for an action, a click, or a file download.

1. Hover your mouse over any links to see the actual destination URL in the bottom corner of your browser.
2. Check the 'From' address closely for extra letters, numbers, or different domains (e.g., .co instead of .com).
3. Look for generic greetings like 'Dear Customer' or 'Dear Account Holder' instead of your name.
4. Verify the request through a different communication channel, like a phone call or a new, separate email message to the known address.
5. Check for spelling and grammar errors, as professional organizations usually have multiple layers of review for their communications.
6. If an attachment ends in .zip, .exe, or .scr, do not open it under any circumstances.

Building a culture of reporting

A business is most secure when employees feel comfortable reporting potential threats. If someone clicks a link, they should feel safe telling the IT team immediately rather than trying to hide it. The faster a threat is reported, the faster it can be contained. Use regular training sessions to show real-world phishing email examples and explain that everyone is a target.