Would you recognize a phishing email if it landed in your inbox today?

It might look like a message from your bank, an online store, a delivery company, your workplace, or a service you use regularly. It may contain familiar branding, professional-looking formatting, and a convincing reason to click a link or open an attachment.

That’s what makes phishing so effective.

Phishing emails are deceptive messages designed to trick people into revealing sensitive information, clicking potentially harmful links, opening attachments, or making payments. The Federal Trade Commission (FTC) says scammers commonly impersonate trusted organizations and create stories involving account problems, suspicious activity, invoices, payments, refunds, or other urgent situations.

In this guide, we’ll examine 20 phishing email examples, explain the warning signs behind each one, and show you how to safely evaluate suspicious messages without falling for the trap.

Important: The examples below are fictionalized for educational purposes. Their goal is to help you recognize phishing patterns, not reproduce actual scam messages.

What Is a Phishing Email?

A phishing email is a fraudulent message that attempts to persuade someone to take an action that benefits a scammer.

The attacker may want to:

• Steal usernames or passwords
• Obtain financial information
• Collect personal information
• Gain access to an account
• Trick someone into sending money
• Encourage the recipient to download harmful software

Phishing often relies on social engineering. Instead of attacking technology directly, scammers manipulate human behavior by creating urgency, fear, curiosity, or excitement.

CISA explains that phishing can involve malicious links or attachments and that attackers may impersonate trusted people, organizations, or services to persuade victims to interact with them.

The most important lesson is this: don’t judge an email only by how professional it looks.

How to Analyze a Phishing Email Example

Before looking at individual examples, use this simple checklist whenever an unexpected message arrives.

Check the sender

Does the complete email address actually belong to the claimed organization or person?

Check the context

Were you expecting this message?

Check the request

What does the sender want you to do?

Check the urgency

Are you being pressured to act immediately?

Check links and attachments

Is the message directing you somewhere unexpected or providing a file you weren’t expecting?

Check independently

If the message might be legitimate, contact the organization using a website, phone number, or other contact method you already know is genuine.

The FTC specifically recommends avoiding unexpected links and attachments and independently contacting an organization rather than using contact information supplied in a suspicious message.

20 Phishing Email Examples You Should Know

1. Fake Bank Account Alert

Example scenario:
You receive an email claiming that suspicious activity has been detected on your bank account and you’re asked to verify your identity.

Warning signs

• Unexpected security alert
• Urgent language
• Request to log in
• Link to “verify” information
• Possible request for financial or login information

This type of phishing email works because people naturally worry about their bank accounts.

What to do: Don’t use the link in the email. If you’re concerned, open your bank’s official website independently or contact the bank using a trusted phone number.

2. Fake Password Reset Email

Example scenario:
An email says someone attempted to access your account and asks you to reset your password immediately.

Warning signs

• You didn’t request a password reset
• The message creates fear
• It contains an unexpected login link
• You’re pressured to act quickly

If you really need to change your password, navigate to the service independently rather than using an unexpected email link.

3. Fake Invoice Email

Example scenario:
You receive an unexpected invoice claiming that a payment is overdue.

Warning signs

• You don’t recognize the invoice
• The sender is unfamiliar
• An unexpected attachment is included
• You’re threatened with late fees or account suspension

Fake invoices are a common phishing theme. The FTC lists unrecognized invoices and payment-related stories among common phishing tactics.

4. Fake Delivery Notification

Example scenario:
An email claims that a package couldn’t be delivered and asks you to click a link to arrange another delivery.

Warning signs

• You aren’t expecting a package
• The message asks for payment
• There’s an unexpected link
• It creates urgency

Delivery messages can be particularly convincing because many people regularly receive online orders.

The FTC has warned about phishing messages impersonating delivery services and other familiar companies.

5. Fake Account Verification Email

Example scenario:
A service claims that it couldn’t verify your account information and asks you to confirm your details.

Warning signs

• Unexpected verification request
• Personal information request
• Urgent deadline
• Suspicious link

CISA has used fake account-verification messages as examples of common phishing lures.

6. Fake Refund Email

Example scenario:
The email claims that you’re entitled to a refund and asks you to provide information to receive it.

Warning signs

• You weren’t expecting a refund
• The sender is unfamiliar
• Personal or financial information is requested
• You’re asked to follow a link

Unexpected refunds are attractive because they encourage curiosity and excitement.

7. Fake Online Shopping Order

Example scenario:
An email says there is a problem with an online order and asks you to confirm your payment details.

Warning signs

• You don’t recognize the order
• The company name looks familiar but the message wasn’t expected
• Payment information is requested
• There’s an unfamiliar link

If you’re unsure, open the retailer’s official website independently and check your order history.

8. Fake Streaming-Service Warning

Example scenario:
A message claims your subscription will be suspended unless you update your payment information.

Warning signs

• Account suspension threat
• Urgency
• Payment request
• Unexpected login link

The combination of a familiar service and a potential loss of access can make this type of message especially persuasive.

9. Fake Social Media Security Alert

Example scenario:
An email claims that someone has accessed your social-media account and asks you to log in immediately.

Warning signs

• Fear-based language
• Unexpected security notification
• Login request
• Suspicious link

Instead of clicking the message, access the platform through its official app or website.

10. Fake Cloud Storage Notification

Example scenario:
An email claims your cloud storage is full and asks you to sign in or upgrade your account.

Warning signs

• Unexpected storage warning
• Pressure to act
• Familiar branding
• Login link

Even when the branding looks genuine, independently accessing the service is safer than clicking an unexpected message.

11. Fake Microsoft or Google Security Alert

Example scenario:
The message claims unusual login activity has been detected and asks you to review your account.

Warning signs

• Unexpected security alert
• Urgent language
• Login link
• Sender address doesn’t match expectations

Security alerts can be legitimate, so don’t automatically ignore them. Instead, verify them through the service’s official website or app.

12. Fake Prize or Giveaway Email

Example scenario:
An email claims you’ve won a prize even though you don’t remember entering a contest.

Warning signs

• Unexpected prize
• Request for personal information
• Processing or delivery fee
• Urgent response requirement

The FTC identifies fake prizes, coupons, and rewards as common scam themes.

A simple rule helps: if you never entered, be skeptical about winning.

13. Fake Tax or Government Refund Email

Example scenario:
An email claims you’re eligible for a government refund and asks you to provide information to receive it.

Warning signs

• Government impersonation
• Unexpected refund
• Sensitive-information request
• Urgent deadline

Don’t assume a government-looking message is genuine. Verify the communication through the relevant agency’s official website.

14. Fake Tech Support Email

Example scenario:
The email claims your computer or account has a serious security problem and instructs you to contact someone or provide information.

Warning signs

• Unexpected security warning
• Fear-based language
• Urgent instructions
• Request for personal information or remote access

The FTC warns that tech-support scams can use frightening claims about computer problems to persuade people to hand over money or access.

15. Fake Job or Recruitment Email

Example scenario:
An unexpected recruiter offers an attractive job opportunity and asks for personal information or payment before proceeding.

Warning signs

• Unexpected job offer
• Unverifiable employer
• Request for sensitive information
• Pressure to act quickly
• Unexpected payment requirement

Before sharing information, independently research and verify the organization.

16. Fake Executive or Boss Email

Example scenario:
An employee receives a message that appears to come from a manager requesting an unusual payment or confidential action.

Warning signs

• Unexpected financial request
• Urgency
• Secrecy
• Sender-address inconsistency
• Request to bypass normal procedures

In a workplace, verify unusual requests through a separate trusted communication channel.

17. Fake Vendor or Supplier Email

Example scenario:
A supposed supplier asks a business to change its bank details for future payments.

Warning signs

• Unexpected account-number change
• New payment instructions
• Urgency
• Request to bypass established procedures

This type of fraud can cause significant financial losses for businesses. Never change payment information based solely on an unexpected email.

18. Fake Shared-Document Notification

Example scenario:
An email claims someone shared an important document with you and asks you to sign in to view it.

Warning signs

• Unexpected document
• Unknown sender
• Login request
• Suspicious link

If you’re expecting a document, access your cloud-storage or collaboration platform directly rather than relying on the email link.

19. Fake Charity or Donation Request

Example scenario:
An emotional message asks you to donate immediately to help victims of an emergency.

Warning signs

• Emotional pressure
• Unfamiliar organization
• Unusual payment method
• Difficulty verifying the charity

If you want to donate, independently find the organization’s official website rather than using a link from an unexpected email.

20. “Too Good to Be True” Opportunity

Example scenario:
An email promises unexpected money, an exclusive opportunity, a huge discount, or a valuable reward.

Warning signs

• Unrealistic promise
• Urgency
• Request for personal information
• Upfront payment
• Unverifiable sender

The FTC recommends resisting pressure and being cautious about unexpected requests for money or personal information.

What Do These 20 Phishing Email Examples Have in Common?

Although the scenarios are different, many phishing emails rely on the same psychological techniques.

Warning Sign	Common Example
Urgency	Account alerts
Fear	Security warnings
Curiosity	Shared documents
Excitement	Fake prizes
Trust	Bank or company impersonation
Financial pressure	Fake invoices
Sensitive-data requests	Account verification
Suspicious links	Password resets
Unexpected attachments	Fake invoices

The important lesson is that one clue doesn’t necessarily prove an email is fraudulent. Several warning signs appearing together should make you pause and verify the message.

How to Tell If a Phishing Email Is Fake

When you’re unsure, follow these steps.

1. Check the Full Sender Address

Don’t rely on the display name. Examine the actual email address.

2. Ask Whether You Expected the Message

Did you really place that order? Request that password reset? Contact that company?

3. Don’t Click Unexpected Links

If you need to access an account, visit the official website independently.

4. Don’t Open Unexpected Attachments

An attachment you weren’t expecting deserves extra caution.

5. Look for Pressure

Scammers often want you to act before you have time to verify the story.

6. Verify Through Another Channel

Contact the person or organization using information you found independently.

The FTC specifically recommends contacting organizations through a website or phone number you know is real instead of using information provided in a suspicious email.

Phishing Email Examples vs. Legitimate Emails

Feature	Potentially Phishing	More Trustworthy Approach
Sender	Unexpected or inconsistent	Independently verifiable
Context	Doesn’t match your activity	Fits something you expected
Tone	Urgent or threatening	Appropriate
Links	Unexpected	Independently verified
Attachments	Unexpected	Expected
Request	Sensitive information	Reasonable for the situation
Payment	Unusual instructions	Established process

Remember: legitimate emails can contain mistakes, and phishing emails can look polished. Don’t use grammar or branding alone to determine whether a message is safe.

What to Do If You Receive a Phishing Email

If you suspect a message is phishing:

1. Don’t click links.
2. Don’t open unexpected attachments.
3. Don’t reply with personal information.
4. Verify the request independently if necessary.
5. Report the message using the appropriate reporting feature.
6. Delete it after reporting.

The FTC recommends reporting phishing messages and deleting them after you’ve dealt with the report.

What to Do If You Accidentally Clicked a Phishing Link

Don’t panic. The appropriate response depends on what happened.

If you clicked a suspicious link:

• Stop interacting with the message.
• Don’t enter additional information.
• If you submitted a password, change it through the legitimate service.
• Enable multi-factor authentication where available.
• If a suspicious file was downloaded, use your device’s security tools as appropriate.
• Tell a trusted adult, parent/guardian, school IT team, or workplace security team when relevant.
• Report the phishing attempt.

If you entered financial or other sensitive information, contact the affected organization using independently verified contact information.

The FTC advises updating security software and running a scan if you believe a suspicious link or attachment downloaded harmful software.

How to Prevent Phishing Attacks

Recognizing phishing is important, but prevention habits provide another layer of protection.

Enable Multi-Factor Authentication

MFA can make it harder for someone to access an account even if they obtain your password. The FTC recommends using multi-factor authentication where available.

Keep Your Software Updated

Install security updates for your operating system, browser, email application, and security software.

Use Email Filters

Spam and phishing filters can keep many unwanted messages away from your main inbox, although they aren’t perfect.

Use Strong, Unique Passwords

Avoid reusing the same password across important accounts.

Develop a “Stop, Check, Verify” Habit

When an unexpected email arrives:

Stop. Don’t react immediately.

Check. Examine the sender, context, links, attachments, and request.

Verify. Confirm the message through a trusted channel.

Frequently Asked Questions About Phishing Email Examples

What is an example of a phishing email?

A common example is a fictional bank alert claiming that suspicious activity occurred and asking the recipient to click a link to verify the account.

What are the most common phishing email examples?

Common categories include fake bank alerts, password resets, invoices, delivery notifications, account verification messages, refunds, security alerts, job offers, and payment requests.

How can I tell if an email is phishing?

Check the sender, context, request, urgency, links, attachments, and spelling or formatting. Most importantly, verify unexpected requests independently.

Can phishing emails look legitimate?

Yes. Scammers can imitate familiar organizations and use convincing designs. The FTC specifically warns that phishing messages can look like they come from companies people know and trust.

Are phishing emails always poorly written?

No. Grammar mistakes can be a clue, but professional writing doesn’t prove that a message is legitimate.

Should I click a link to see whether an email is legitimate?

No. If you’re uncertain, access the organization’s official website independently rather than testing the email’s link.

What should I do with a phishing email?

Avoid interacting with it, report it through an appropriate channel, and delete it afterward.

Phishing Email Safety Checklist

Before interacting with an unexpected email, ask:

• ☐ Do I recognize the sender?
• ☐ Does the complete sender address look legitimate?
• ☐ Was I expecting this message?
• ☐ Does it create unusual urgency?
• ☐ Is it requesting sensitive information?
• ☐ Does it contain an unexpected link?
• ☐ Does it contain an unexpected attachment?
• ☐ Is there an unusual payment request?
• ☐ Does the message match my recent activity?
• ☐ Can I verify the request independently?

If several answers raise concerns, stop before taking action.

Final Takeaway: Don’t Memorize the Scam—Learn the Pattern

The biggest lesson from these 20 phishing email examples is that you don’t need to memorize every scam.

Instead, learn the patterns.

A phishing email may impersonate a bank, employer, delivery service, online platform, government agency, or someone you know. The story changes, but the tactics often remain similar: urgency, impersonation, unexpected requests, suspicious links, attachments, fear, curiosity, or promises that seem too good to be true.

When something feels unusual, remember:

Stop → Check → Verify

Don’t let an unexpected email rush you into making a decision.

Take a moment to inspect the sender. Think about whether you expected the message. Avoid unexpected links and attachments. Then verify the request using a trusted communication channel.

Phishing tactics continue to evolve, so the best defense is an informed and cautious approach.

Did one of these 20 phishing email examples look familiar? Share this guide with your friends, family, classmates, coworkers, or anyone who could benefit from learning how to recognize suspicious emails. A few seconds of caution can prevent a much bigger problem.