Phishing email examples share a pattern: an ordinary-looking message from a trusted sender that pushes you to click, open a file or pay. Check the sender’s real domain and the link destination before acting; if you already clicked, change passwords starting with email.
The templates below show what each scam says and where it gives itself away. For wider habits, see our guide on how to protect yourself from hackers.
How a phishing email works
A phishing email looks like an ordinary message from someone you trust, according to Hook Security’s phishing examples. Typical disguises are a sign-in alert, an invoice, a delivery notice or a note from your manager. The disguise matters less than the pressure attached to it. A deadline collapses the gap between reading and acting, which is why urgency appears in almost every template.
Most attacks then run in three stages:
- The lure. A message imitates a familiar sender and asks for something small: confirm a payment, approve a sign-in, open a document.
- The click. The link leads to a spoofed page. In a story published by Indiana University, a recipient clicked a link and landed on a spoofed IU CAS login page, where her credentials were captured.
- The payoff. The attacker uses the stolen login, or, as the same IU account notes, a single click could also have installed malware on a mobile device or computer.
Because the harm usually begins at the click, the most useful habits happen before it. The next section shows the lure stage in concrete form.
Annotated phishing email templates
These five templates cover what recipients most often see. Each pairs the wording with the red flag that gives it away and a safer response.
| Template | What the email says | Red flag | Safer response |
|---|---|---|---|
| Fake invoice | Subject: “Invoice #4471 is past due, payment required today” | A same-day deadline leaves no time to think | Check the invoice against your own records before paying anything |
| Fake security alert | A sign-in was blocked, with a button to approve or review it | A real block does not need your approval to stay blocked | Ignore the button and sign in the way you normally do |
| Executive impersonation | A short note under a senior leader’s display name that asks you to reply | The real request (gift cards, a wire or a document) only comes after you reply | Do not reply; confirm with the leader through a known channel |
| Lookalike brand sender | “Your recurring card payment to GEICO was declined” | The sender domain is financialadvicers.com, not the brand’s | Judge the message by the domain after the @ |
| Payment-detail change | A supplier or colleague asks you to update bank details | Payment details should never change because of an email | Call a number you already have on file |
The wording, patterns and red flags in this table follow Hook Security’s phishing email examples.
The security-alert template is the one most likely to catch careful people, because its “approve” button feels like protection. The fix is to treat any message that asks you to authorise something as a prompt to open the real account separately. For stronger sign-in protection behind that habit, see Two-Factor Authentication Examples: 7 Real-World Methods to Secure Your Accounts in 2026 – Cubeguard.
Spear phishing and business email compromise
Spear phishing is more targeted than bulk phishing and does not necessarily start with a link or attachment, according to IRONSCALES. The first message may be a harmless-looking question that exists only to start a conversation. That is why “no link, no attachment, so it is safe” is a poor rule for anyone who handles money or sensitive records.
Business email compromise follows the same logic with a financial goal. The executive-impersonation and payment-change templates above are typical: a short note from a senior name, then a request for gift cards, a wire or a document once you engage. Two habits suit this threat better than spotting typos:
- Verify outside the email. Confirm any change to payment details by calling a number already on file, never one printed in the message.
- Treat a reply as a commitment. With executive impersonation the dangerous request arrives only after you answer, so check the sender before you engage at all.
Checking for sender spoofing
A spoofed email carries a forged sender name or address. Spoofing is the method; phishing is usually the goal. The display name is the easiest part to fake, so the domain after the @ is what counts. A name that reads like your bank or your manager tells you nothing until the full address behind it checks out.
The visible sender is also weaker evidence than it appears. IRONSCALES notes that only the From header is shown to recipients, while the Mail From address can differ and can be completely manipulated by the attacker. Mail systems can catch some forgeries: an SPF check validates the sending server’s IP address against the IP addresses the domain allows. You cannot see that check from the inbox, so your own check of the domain remains the first line of defence.
Organisations sometimes add their own markers. Indiana University advises tapping the sender’s name to see the real reply-to address and looking for IU’s Trusted Security Footer, which indicates a message from a trustworthy sender, as described in its phishing stories.
Checking links and attachments
Preview a link before you trust it: hover over it on a desktop, or long-press it on mobile. If the destination does not match the organisation the email claims to come from, stop there. Previewing costs a second and avoids the spoofed login page described earlier.
Attachments deserve equal suspicion. Hook Security notes that malicious files arrive as HTML pages, QR codes or “secure documents”. None of those formats looks like a classic virus, and a QR code skips the link preview entirely because you scan it with a phone. If a file you did not expect asks you to sign in to open it, treat it as a credential trap and confirm with the sender by another route.
Red flag checklist
Every sample in Hook Security’s collection has the same five parts, so work through them in order:
- Sender. Read the full address and the domain after the @, as covered above.
- Subject line. Look for a manufactured deadline or a payment problem, like the “past due, payment required today” example.
- Greeting and tone. Ask whether the style matches how this person or company normally writes to you, and whether it leans on urgency or authority.
- The ask. Decide what the email wants: a login, a payment, a changed bank detail, a reply. Requests for credentials or money are the highest-risk asks.
- Links and attachments. Preview every link and distrust any file you were not expecting.
One failed check is enough reason to leave the message alone and contact the sender through an address or number you already trust.
If you clicked a phishing link
Act in this order, using Indiana University’s guidance for a recipient who entered her details on a spoofed page:
- Change your passwords, starting with email. IU advises changing the passphrases for all affected accounts, beginning with email and then moving to banks. Email comes first because it can be used to reset the rest. A tool such as the one in Best Password Managers For Seniors: Simple, Secure, And Easy To Use In 2026 – Cubeguard can help you keep track of new passwords.
- Watch your finances. Monitor credit reports and credit card statements for fraud.
- Assume the device may be affected. IU points out that even one click could have installed malware on a phone or computer, so ask your IT or support team for help if the device is managed for you.
- Report it. IU’s example has the person contact the campus UITS Support Center to request a passphrase scramble and to report the phish.
These steps come from IU’s phishing stories. Speed matters more than perfect wording: change the email password first, then work down the list.
Where to report phishing
Report to whoever runs the mailbox. At a university, that is the support centre named in the IU example. At work, it is your IT or security team, and you should follow whatever reporting route your employer gives you. On a personal account, use the report option your email provider offers. Report even if you did not click, because a message sent to you was probably sent to colleagues too.
Reporting works best when people have practised it. IRONSCALES describes security awareness training as reducing phishing risk by teaching employees to recognise and report suspicious messages. Sample emails like the templates above make useful training material for small teams.
Frequently asked questions
Is a spoofed email the same as a phishing email?
No. Spoofing is the method: an email with a forged sender name or address. Phishing is usually the goal the forgery serves, such as stealing a login or a payment.
Can a phishing email arrive without a link or attachment?
Yes. Spear phishing is more targeted and may open with neither, relying on a reply from you before the real request appears.
Does an official-sounding message prove it is genuine?
No. Indiana University warns that scammers often use terms that seem official and plausible, such as a fake employee portal. IU also states that it will never ask anyone for a passphrase, a useful reminder that real organisations do not collect passwords by email.
Why does the security-alert email ask me to approve something?
That request is the tell. A real blocked sign-in does not need your approval to stay blocked, so a button asking for approval points to a lure.
