Phishing email examples share a handful of giveaway signs: a spoofed sender address, an urgent threat, a mismatched link, and a request that skips your usual approval process. Once you know the pattern, most attempts take seconds to spot.
Criminals send these emails because volume beats precision. Here are 12 real-world phishing formats and the exact detail that gives each one away.
The Fake Invoice
A PDF or link labelled “Invoice Overdue” arrives from a supplier you barely recognise. The giveaway: the invoice number matches nothing on file, and the sender domain is one letter off from the real company.
The Unrequested Password Reset
“Someone tried to access your account” lands with a reset link. Check the destination before clicking. Genuine resets point to the exact domain of the service, never a lookalike like “micros0ft-security.com”.
The CEO Wire Transfer Request
This is a classic form of whaling phishing, where the attacker impersonates a senior executive and pushes a finance employee to move money urgently. The tell is tone: real executives rarely demand secrecy or a specific transfer amount by email.
The Shipping Notification
“Your parcel could not be delivered” arrives with a tracking link. Real couriers format tracking numbers consistently. If the email names no specific retailer, treat it as fake.
The HR Policy Update
An email claiming to be from HR asks you to log in and review a new policy. The link routes to a cloned login page built to harvest your credentials. Hover over the button and check the URL bar, not the button text.
The Tax Refund Notice
Government-branded phishing spikes every filing season. A fake refund notice asks for bank details to “process your payment.” Tax authorities never ask for card or bank details by email.
The Cloud Storage Share
“A file has been shared with you on Google Drive” or similar, except the sender is a personal Gmail address, not the organisation’s real account. Legitimate shares come from a colleague’s known email, not a stranger’s.
The IT Support Ticket
An email posing as internal IT asks you to install a “security update” via a linked file. This is a common delivery route for trojan malware disguised as legitimate software. IT departments push real updates through managed tools, not unsolicited attachments.
The Fake Antivirus Warning
A pop-up-style email claims your device is infected and links to a scan tool. The “scan” often installs the very software it claims to remove, one of many malware attacks that lean on urgency rather than technical skill. No real vendor emails unsolicited infection warnings.
The Prize or Refund Windfall
You have won a gift card, a refund, or a competition you never entered. This relies on excitement overriding caution. Real companies do not run giveaways that require card details to “verify identity.”
The Compromised Vendor Email
An email from a real supplier’s hacked account asks you to update payment details before an invoice is due. Because the account is genuine, this one slips past most spam filters. Confirm banking changes by phone, using a number you already have.
The Legal Threat
A message claims you are being sued or reported and attaches a “case document” you must open immediately. Fear pushes people to click before they think. Genuine legal notices arrive through formal channels, not a cold email demanding instant action.
What is the most common giveaway sign in phishing email examples?
Mismatched sender domains are the most consistent tell. The display name may look correct, but the address behind it is usually a slightly altered or unrelated domain.
Can a phishing email look completely legitimate?
Yes. Compromised vendor accounts and well-built clone pages can pass a casual glance. Checking the actual link destination matters more than judging an email by appearance alone.
What should you do if you already clicked a phishing link?
Disconnect the device from the network, change any passwords you entered on the fake page, and scan for follow-on malware. Report the email to your IT or security team.
