Phishing Email Examples: Red Flags and What to Do Next

A phishing email seeks to make you disclose information, open harmful content, or act unsafely. It can impersonate a supplier, colleague, or familiar service. Some messages arrive through compromised accounts. A recognizable name, convincing layout, or existing conversation does not establish that a request is safe.

If a work email looks suspicious, stop interacting with it. Use your organization's reporting process and verify urgent requests through a separate, trusted channel.

You do not need to prove that an email is malicious before reporting it. Early reporting gives the security team a chance to assess the message.

The examples below describe documented attack patterns. They are explanations, not reproductions of actual emails or claims about specific incidents.

What Does a Phishing Email Try to Make You Do?

Phishing uses a message to influence the recipient's next action. That action might involve entering credentials, downloading a file, or sending sensitive information. Fraudulent business emails can also redirect payments without a malicious link. Examine the requested action alongside the sender and surrounding context.

The FTC describes phishing messages that invent account or payment problems. Their apparent urgency encourages recipients to act before checking independently.

Common requests include these actions:

• Sign in to resolve an account problem.
• Open an unexpected invoice or shared document.
• Confirm personal, payment, or business information.
• Change a supplier's bank details.
• Approve access or disclose an authentication code.

These requests do not all produce the same consequence. A credential request targets account access. A payment instruction targets the organization's payment process.

That distinction helps employees report what happened accurately. It also helps administrators decide what they need to investigate.

Example 1: An Urgent Account or Password Warning

An account-warning message claims that access will stop unless the recipient acts. It may imitate a familiar service and direct the recipient toward a sign-in page. The warning creates pressure to resolve a problem immediately. Verify the account through your usual application or trusted bookmark instead.

The important question is whether the service shows the same issue independently. Do not use the message's link to answer that question.

A security alert can be legitimate. Treat the email as a reason to check, not as permission to follow its instructions.

Inspect these details without opening suspicious content:

• Whether the warning matches an account you use.
• Whether the requested action fits your organization's process.
• Whether the full sender address matches the claimed organization.
• Whether the message pressures you to bypass normal verification.

A matching sender address still does not settle the question. Attackers can misuse legitimate accounts, and display names can mislead recipients.

If you cannot verify the warning, report the email. Let the responsible team investigate rather than experimenting with its destination.

Example 2: A Supplier Changes Payment Instructions

A fraudulent payment message may claim that a supplier has changed its bank account. It can reference real business activity or appear within an existing conversation. The absence of an attachment does not make the request safe. Verify changes through an established contact method before authorizing payment.

The FBI's business email compromise guidance specifically addresses payment changes and account impersonation. It recommends independent verification of payment procedures and account numbers.

Use the supplier's verified contact details already held by your organization. A phone number supplied in the suspicious message is part of the unverified request.

Do not rely on replying to the conversation. If someone controls the mailbox, that person may also answer the reply.

The approval process should preserve a record of verification. Identify who confirmed the change and how they contacted the supplier.

If money has already moved, contact the financial institution immediately. Ask about recovery procedures and follow your organization's incident process. The FBI also directs US victims to report business email compromise through IC3.

Example 3: An Unexpected Document or Attachment

A message can use a document request to make harmful content seem relevant to daily work. The recipient might expect invoices, résumés, or project files. Familiar business context can therefore increase credibility. Verify an unexpected request before opening its attachment or following its access instructions.

A recognizable file-sharing brand does not establish the sender's identity or the request's legitimacy. Access the service through your normal route when possible. Check whether the expected document or conversation exists there.

If a colleague appears to send the file, contact that person separately. Use a known number or another established communication channel.

Pay attention when the request asks you to change security settings. Do not enable active content or install software because an unexpected document tells you to.

An attachment's appearance does not establish what it will do. Ask the security team to assess suspicious files through approved tools.

Do not upload confidential attachments to public scanning websites without authorization. That could disclose business information while you are trying to investigate a threat.

Which Warning Signs Deserve Attention?

Warning signs help you decide when to pause, but they do not provide a definitive verdict. Some malicious emails look professional and contain accurate details. Some legitimate messages contain mistakes. Evaluate the request and verify independently rather than relying on one visual clue.

Use these signals as prompts for investigation:

1. Unexpected urgency
2. New payment details
3. Unfamiliar sign-in request
4. Unexpected attachment
5. Request for an authentication code

Poor spelling can raise suspicion, but correct spelling does not prove legitimacy. A company logo offers similarly limited evidence.

Avoid reducing training to a search for obvious mistakes. Employees need a safe next action when a message looks convincing.

When discussing prevalence, distinguish phishing attempts from later attack stages. A message received, a link clicked, and an account compromised describe different events.

How Should Employees Verify a Suspicious Request?

Verify through a route that does not depend on information inside the suspicious message. Use a known application, stored contact, or established internal process. Keep verification separate from the original conversation. If uncertainty remains, report the message and pause the requested action.

For a work account, follow this sequence:

1. Stop interacting with the message, attachment, or destination.
2. Open the relevant service through your usual trusted route.
3. Contact the supposed sender through independently verified details if needed.
4. Report the message using the organization's approved method.
5. Preserve information according to the response team's instructions.

Avoid forwarding suspicious attachments casually to colleagues. Use the reporting function or submission method your security team provides.

A screenshot can help describe what you saw. It does not replace the original message and technical information investigators may need.

If your organization lacks a reporting process, ask the responsible IT contact for one. Employees should know how to report concerns before an incident creates pressure.

What Should You Do After Interacting with the Email?

Tell the response team exactly what you did and when. Clicking a link differs from entering a password or opening a downloaded file. Those details guide investigation. Do not assume either that nothing happened or that every interaction caused a confirmed compromise.

Separate the situations before choosing the response:

For a personal account, use the provider's official recovery process. Reach it independently rather than through the suspicious message.

On a managed work device, follow your organization's incident instructions. Avoid improvising cleanup steps that could interfere with investigation.

When Credentials or Account Access May Be Exposed

A password change may form part of recovery, but it does not finish every investigation. Administrators may also need to review sessions, registered authentication methods, and account changes.

Microsoft's compromised cloud email account response includes account containment and session revocation. It also covers suspicious forwarding, authentication registrations, application consent, and administrative roles.

Those procedures apply to the documented environment. Other services have their own controls and recovery instructions.

Employees should report any unexpected approval they accepted. Include a code disclosure even if the password remained private.

When a File or Device May Be Involved

Report whether you downloaded a file, opened it, or ran anything. Include any prompts you accepted and any unusual behavior afterward.

The response team can assess whether the device needs isolation or further examination. Follow its directions for managed equipment.

The FTC recommends security-software updates and scanning when harmful software may have downloaded. Work devices can require additional investigation under the organization's response process.

Do not treat a quiet screen as evidence that the device is unaffected. Equally, avoid claiming a breach before investigators establish what happened.

What Information Helps the Security Team?

A useful report describes the message and the recipient's actions without speculation. Include enough detail to establish a timeline. Use the approved reporting channel and follow instructions for preserving evidence. Do not delay reporting while trying to build a complete investigation yourself.

Include the details you already know:

• The sender address and subject line.
• The approximate arrival and interaction times.
• The account and device involved.
• Whether you clicked, downloaded, entered information, or approved a prompt.
• Whether payment details changed or money moved.
• Any unexpected changes you noticed afterward.

Never include passwords or authentication codes in the report. Describe the disclosure without repeating the secret.

An organization should also identify who receives reports outside normal hours. A mailbox nobody monitors cannot provide a timely response by itself.

What Reduces the Risk Beyond Employee Vigilance?

Phishing defense combines people, technical controls, and business procedures. Reporting and independent verification support that defense, but they cannot replace account protection. Organizations should also address multifactor authentication, permissions, email security, and recovery. No individual control makes every fraudulent message harmless.

Manage identity access across the employee lifecycle so old accounts and inappropriate permissions do not persist. Review access when employees join, change roles, or leave.

For payment requests, maintain verification rules even when a message appears to come from leadership. Urgency should not authorize a different payment process.

Keep incident language precise. Data breach statistics and broader cybersecurity statistics count outcomes that differ from attempted phishing. Your internal reporting should distinguish suspicion, confirmed access, and verified information exposure. Each reported phishing email adds evidence the response team can use.

Frequently Asked Questions

Resources

Further official guidance includes CISA's phishing tip sheet and the FBI Internet Crime Complaint Center. Use your organization's incident procedure for work accounts and managed devices.