A suspicious email does not need to look obviously fake to be dangerous. This guide gives you a repeatable way to inspect the sender, reply-to address, links, attachments, wording, and request before you respond. It also includes 25 realistic fake email examples and a safe workflow for verifying the message without using its contact details.
Overview
Phishing is an attempt to make you reveal information, open a harmful file, send money, or approve an action by pretending to be a trusted person or organization. A phishing email may imitate a bank, delivery company, employer, cloud service, payment provider, or colleague. Some messages contain spelling mistakes; others use polished branding and convincing language.
The safest rule is simple: treat an unexpected request as untrusted until you verify it independently. Do not click a link, open an attachment, call a number in the message, or reply with personal information while you are still deciding whether the email is genuine.
Look for several signals together rather than relying on one clue. A familiar logo proves little. A message can use the correct name and still come from a look-alike domain. Conversely, an unusual design does not automatically prove fraud. Your goal is to compare what the email claims with what you can confirm through a separate, official channel.
The fast phishing email test
- Pause: Identify what the message wants you to do and why it arrived now.
- Inspect: Check the full sender address, reply-to field, link destination, attachment, and payment instructions.
- Verify: Open the official app or type the known website address yourself. Do not use the message's links or phone numbers.
- Report and remove: Use your email provider's phishing-report option, then delete or quarantine the message.
Checklist by scenario
These fake email examples are intentionally generic. They show common patterns without reproducing live scam links or dangerous attachments. In each case, the safest response is to verify through an independently obtained channel.
Bank and payment messages
- Fake bank lockout: “Your account has been restricted. Confirm your identity within two hours.” Red flags: severe urgency, a login link, and a request to enter credentials.
- Unrecognized transfer: “A payment of $640 is pending. Click here to cancel.” Red flags: fear of loss and a cancellation link rather than a transaction notice inside the official banking app.
- Card replacement request: “Your card will stop working unless you confirm your address and card number.” Red flags: a request for sensitive card data by email.
- PayPal scam email: “Your payment is on hold. Reply with your full name, password, and security code.” Red flags: asking for a password or one-time code and using reply as the verification method.
- Refund notice: “You are owed a refund. Provide your bank details to receive it today.” Red flags: an unexpected refund and collection of financial information before any independent confirmation.
Delivery and shopping messages
- Parcel delivery scam: “We could not deliver your package. Pay a small redelivery fee.” Red flags: an unexpected fee, a shortened link, and no order reference you recognize.
- Customs demand: “Your international parcel is held until you submit identification.” Red flags: pressure to upload identity documents from an unsolicited email.
- Amazon scam message: “Your order was canceled because your billing information failed. Sign in to restore it.” Red flags: a login link and a problem with an order you may not have placed.
- Fake store receipt: “Thank you for your purchase. Download the invoice to see shipping details.” Red flags: an attachment for an unfamiliar order.
- Gift card request: “Buy several gift cards for a client and send the codes immediately.” Red flags: secrecy, urgency, and a request to transmit gift-card numbers.
Work and payroll messages
- Payroll change: “Your direct-deposit details are outdated. Update them before the next payroll run.” Red flags: a financial-account change requested through an email link.
- Executive impersonation: “I am in a meeting. Purchase vouchers and keep this confidential.” Red flags: authority, secrecy, unusual payment instructions, and a request to bypass normal approval.
- Job offer scam: “You have been selected. Pay for equipment before your onboarding call.” Red flags: payment before employment is verified and a rushed process.
- Shared document lure: “A confidential performance review is waiting for you.” Red flags: a login prompt for a cloud service and a vague document title.
- Tax or benefits update: “Confirm your government or benefits number to avoid suspension.” Red flags: threats, sensitive identity data, and an unverified sender.
Cloud, account, and technology messages
- Microsoft-style alert: “Unusual sign-in detected. Verify your account now.” Red flags: a look-alike sender domain, a login page reached through email, and a demand for a password.
- Password expiration: “Your mailbox will be deleted today unless you renew your password.” Red flags: an unrealistic deadline and a link that does not match your organization's normal sign-in process.
- Cloud storage warning: “Your storage is full. Open the attached file to review large items.” Red flags: an unexpected attachment and pressure to open it.
- Security software renewal: “Your protection has expired. Call this number to prevent infection.” Red flags: unsolicited technical support and a phone number supplied by the email.
- QR code login: “Scan this code to secure your account.” Red flags: the destination is hidden until after scanning, making the link harder to inspect.
Social, charity, and relationship messages
- Account appeal: “Your social profile violated a rule. Submit an appeal within 30 minutes.” Red flags: a short deadline and a login link.
- Charity emergency: “Donate cryptocurrency immediately to help victims.” Red flags: emotional pressure, unusual payment methods, and no independently verified charity page.
- Contact impersonation: “I lost my phone. Send money to this new account.” Red flags: a changed contact method and a request that avoids a voice or in-person confirmation.
- Romance or travel emergency: “I am stranded and need funds today. Please keep this private.” Red flags: secrecy, urgency, and money requested from an online contact.
- Prize notification: “You won a reward. Pay processing costs to claim it.” Red flags: a prize you did not enter and an upfront payment demand.
A single red flag may be explainable, but multiple signals should stop the interaction. If the email asks for a password, one-time code, full payment-card details, gift-card codes, cryptocurrency, or a change to payroll or banking information, verify it using a channel you find yourself.
What to double-check
1. The visible sender versus the real address
Display names are easy to copy. Expand the sender details and inspect the complete address. Be cautious about misspellings, extra words, unexpected countries or domains, and free-mail addresses used for an organization that normally uses its own domain. Also check the reply-to field: a message can display one address while directing your response somewhere else.
2. The destination of every link
On a computer, hover over a link without clicking. On a phone, press and hold only if your mail app safely previews the destination. Read the domain from right to left and watch for look-alike spellings, extra subdomains, shortened links, and unfamiliar login pages. Do not paste a suspicious link into an online checker if doing so could expose private tokens or account information. When in doubt, type the known official address yourself or use the organization's established app.
3. The request and its timing
Ask what the sender wants and whether that action makes sense. Unexpected account warnings, urgent refunds, password resets, invoice changes, delivery fees, and confidential requests deserve extra scrutiny. Real organizations may send genuine alerts, so urgency alone is not proof of fraud; it is a reason to stop and verify.
4. Attachments and unusual file types
Do not open an unexpected attachment merely to identify it. Be especially cautious with files that ask you to enable macros, run a program, install an app, enter a password, or bypass a security warning. Confirm the document through the sender's known contact method and use updated security software before opening any file you genuinely need.
5. The message headers and context
If the message remains uncertain, view its technical details or headers. Look for inconsistencies between the visible sender, return path, and authentication results. Header information can be difficult to interpret and is not a complete verdict, so treat it as additional evidence rather than proof. Check whether you actually have an account, order, delivery, job relationship, or conversation connected to the email.
6. Independent verification
Use a bookmark, manually typed address, official app, account statement, or phone number from a trusted record. Do not use contact information supplied in the suspicious message. For a workplace request, confirm through a separate chat, known phone number, or established approval process. For a friend or family member, contact the person through a different channel.
Common mistakes
- Trusting branding: Logos, signatures, and familiar colors can be copied. Verify the address and request instead.
- Clicking to “see where it goes”: A link can load a fake login page or trigger a download. Inspect or avoid it.
- Replying to ask if it is real: A reply confirms that your address is active and reaches the same untrusted sender.
- Calling the number in the email: A scammer may answer while pretending to be support. Find the number independently.
- Using a search result as the only check: Search ads and copied pages can also mislead. Navigate from a known official source.
- Sharing one-time codes: A legitimate support representative or employer should not need you to disclose an authentication code to prove ownership.
- Forwarding the email without care: Preserve it for reporting, but remove personal data before sharing screenshots or examples publicly.
- Assuming grammar is decisive: Poor wording can be a clue, but polished phishing messages exist. Focus on the action, identity, and destination.
If you clicked a link or supplied information, act promptly. Change affected passwords from a trusted device, sign out other sessions where possible, contact the relevant bank or service through an official channel, and monitor accounts for unfamiliar activity. If money was sent, document the transaction and contact the payment provider quickly. For a broader response plan, see what to do after sending money to a scammer and review the identity theft warning signs guide.
When to revisit
Use this checklist whenever an email asks you to log in, pay, download, disclose information, or act unusually fast. Revisit the guide before seasonal planning cycles, major payroll or tax periods, travel seasons, and periods when you expect many delivery or account notices. Organizations and email providers can change their reporting menus, authentication screens, and normal notification formats, so confirm the current steps inside your own mail service before relying on them.
For a reusable decision checklist, copy this:
Pause. Do not click, reply, call, pay, scan, or open. Inspect the full sender and reply-to address. Preview the destination without visiting it. Check the request, urgency, attachment, and account context. Verify through an official channel found independently. Report the message as phishing. Delete or quarantine it. If information or money was shared, secure the account and contact the provider immediately.
Keep this workflow available for the next suspicious message. It is more reliable than trying to memorize every fake email design, because the same underlying tactics continue to appear under different brands and stories. For related checks, see our guide to spotting phishing emails or texts, verifying a job offer, or checking whether an app is safe before installing it.
