Home > Phishing training > Phishing examples
PHISHING EXAMPLES
They look real on purpose. Here is how to see through them.
Phishing email examples explained: spot the red flags
Today's phishing does not have bad spelling and a foreign prince. It looks like your bank, your boss, your vendor or a document waiting for signature. Below are five of the most common scams we see, written out the way they arrive, with the warning signs pointed out.
✓ Use these in your next staff meeting★ Examples are made up for training
The short answer
- Check the real sender address and the real link before you click. Hover or press and hold to see it.
- Watch for urgency, secrecy, a change in payment details, or a request for a code or password.
- When in doubt, contact the person or company a different way, using a number or site you already know.
- Report it to your IT provider, then delete it.
Example 1: the fake invoice
From: Accounts Receivable <billing@yourvendor-invoices.co>Subject: Past due invoice #48213, action required
Hello, please see the attached past due invoice. Our bank details have changed, so please use the new account on the invoice to avoid a late fee. Payment is needed today.
Hello, please see the attached past due invoice. Our bank details have changed, so please use the new account on the invoice to avoid a late fee. Payment is needed today.
- Look-alike domain: not your vendor's real address.
- Bank change: the number one sign of invoice fraud.
- Urgency: "today" and a late fee threat.
- Do this: call the vendor at the number you already have before paying anything.
Example 2: the password reset
From: Microsoft 365 Security <no-reply@m365-account-alerts.net>Subject: Your password expires in 2 hours
Click below to keep your current password. If you do not act, your mailbox will be locked.
[Keep my password]
Click below to keep your current password. If you do not act, your mailbox will be locked.
[Keep my password]
- Wrong sender: Microsoft does not send from that domain.
- Fear of lockout to rush you.
- The button leads to a fake sign in page that steals your password and MFA code.
- Do this: go to your account by typing the address yourself, never through the email.
Example 3: the document to sign
From: eSign Notification <documents@secure-sign-review.com>Subject: Completed: Payroll adjustment Q4, please review
You have a document waiting. Review and sign by end of day.
[Review document]
You have a document waiting. Review and sign by end of day.
[Review document]
- Unexpected: you were not expecting a document from anyone.
- Tempting topic: payroll, bonus or HR policy.
- Fake brand: uses e-signature look and feel, but the link goes somewhere else.
- Do this: ask the sender by phone, or open the e-signature site directly.
Example 4: the unpaid toll text
Text from +1 (5XX) XXX-XXXXToll Services: You have an unpaid toll balance of $6.99. Pay now to avoid a $50 late fee and license suspension: [short link]
- Small amount so you do not think twice.
- Big threat: fees and license suspension.
- Random number and a short link.
- Do this: check your account on the toll agency's real website. The FBI has warned about this exact scam.
Example 5: the voice clone call
Phone call that sounds exactly like your boss"I am about to walk into a meeting. I need you to send a wire for a vendor right now. I will text you the details. Do not tell anyone yet, it is a surprise for the team."
- AI can copy a voice from a few seconds of video or voicemail.
- Secrecy and urgency together are a red flag.
- Payment by text skips your normal process.
- Do this: hang up and call your boss back at their known number. Use a family or office code word for money requests.
The 5 red flags in every example
⏳UrgencyNow, today, before it is too late.
👤Wrong senderA domain or number that is close but not right.
💰Money or codesPayments, gift cards, passwords or MFA codes.
🤐Secrecy"Do not call," "keep this between us."
How WENO cuts phishing in your office
1. Filter it outEmail protection and a WatchGuard® firewall that blocks known phishing sites.
2. MFA everywhereSo a stolen password alone does not work. See MFA explained.
3. Train with examplesShort sessions like this page, plus safe practice emails. See phishing training.
4. Easy reportingA simple way for staff to report a suspicious message, and fast help if someone clicked.
Your team is the last line of defense.Teach them what real phishing looks like.
Train my teamSources
- FBI Internet Crime Complaint Center: public service announcements
- FTC: How to recognize and avoid phishing scams
All examples are made up for training. Any resemblance to real messages shows how convincing scams can be.