10 Real Phishing Email Examples (And How to Spot Each One)

Phishing emails are the #1 attack vector for credential theft and fraud. Every day, billions of phishing emails are sent worldwide. The good news? Most are easy to spot if you know what to look for. This guide shows you 10 real phishing email examples from the brands scammers impersonate most—and exactly what red flags expose them.

Example 1: PayPal Account Verification Phish

Target: PayPal users. Goal: Steal login credentials and payment information.

Red Flags

• Sender email is account-paypal.com, not @paypal.com
• Generic greeting "Dear PayPal User" instead of your name
• Artificial urgency and threats ("account will be limited")
• Asks to click a link instead of logging in directly on PayPal.com
• No mention of specific suspicious activity—just vague "unusual activity"

Example 2: Microsoft/Outlook Suspicious Sign-In

Target: Outlook, Office 365, and Microsoft account users. Goal: Compromise email and Microsoft services.

Red Flags

• Sender is microsoftservice.com, not microsoft.com
• Generic location info to create urgency
• Button links to a phishing page, not actual account security
• Real Microsoft emails typically show less detail initially
• Signs itself as "Microsoft Security Team" (informal for Microsoft)

Example 3: Apple ID Security Alert

Target: Apple ID users. Goal: Steal Apple ID and trigger password resets on iCloud, iMessage, iTunes.

Red Flags

• Sender is apple-id.com, not apple.com
• All-caps "URGENT" indicates phishing (Apple doesn't use this style)
• Vague threats without specifics
• Pressures immediate action with emotional language
• Real Apple emails rarely ask you to reset your password via link

Example 4: Bank Account Unusual Activity Alert

Target: Bank customers. Goal: Steal online banking credentials and access financial accounts.

Red Flags

• Sender is yourbank-alerts.com (generic, not real bank domain)
• Specific dollar amount ($2,500) creates panic
• Hard deadline (1 hour) to force reckless clicks
• Real banks never ask you to click links to dispute transactions
• Real banks show your actual account number, not just "your account"

Example 5: Google Account Suspicious Activity

Target: Gmail and Google account users. Goal: Compromise Google account and access to Google Drive, Photos, Gmail, YouTube.

Red Flags

• Sender is security-google.com, not google.com
• Foreign location (Russia, Nigeria, China) is a common phishing tactic
• Button says "CHECK ACTIVITY" but links to phishing page
• Real Google alerts show your actual email address, not generic greeting
• Real Google doesn't use "Do not delay" language in emails

Example 6: LinkedIn Account Restricted

Target: LinkedIn users. Goal: Steal LinkedIn accounts to impersonate professionals and target connections.

Red Flags

• Sender is linkedinservice.com, not linkedin.com
• Threats of account deletion to force action
• No details about what "suspicious activity" was detected
• LinkedIn doesn't restrict accounts via email verification links
• Generic greeting without personal information

Example 7: DocuSign/Signature Service Spoofing

Target: Business professionals. Goal: Capture credentials and business documents.

Red Flags

• Sender is docusign-verify.com, not docusign.com
• Generic company name "company.com" instead of real sender
• Artificial urgency ("expires in 24 hours")
• Real DocuSign notifications come from @docusign.com domain
• Button links to fake DocuSign login page

Example 8: Amazon Buyer Protection Claim

Target: Amazon shoppers. Goal: Steal Amazon login and credit card information.

Red Flags

• Sender is amazonservice.net, not amazon.com
• This email targets Amazon sellers, not buyers (unusual)
• Threat of account suspension
• Real Amazon uses different domains for seller services
• No specific details about the claim or buyer

Example 9: Password Expiration Notice

Target: Various services. Goal: Capture new passwords when users try to reset.

Red Flags

• Sender is banking-service.com (generic, not real bank)
• Most services don't force password expiration via email
• Threat of lockout to create urgency
• Button links to phishing password reset page
• Real services ask you to log in directly, not click email buttons

Example 10: Package Delivery Failed Notice

Target: Online shoppers. Goal: Trick users into downloading malware or providing payment information.

Red Flags

• Sender is fedex-update.com, not fedex.com
• Generic message without tracking number or order details
• You may not even be expecting a package
• Asks to update address via email button (unusual for real carriers)
• Real FedEx/UPS include tracking numbers in subject lines

Common Red Flags Across All Phishing Emails

• Wrong domain: Sender email doesn't match the company's real domain (apple-id.com vs apple.com)
• Generic greeting: "Dear Customer" or "Hello" instead of your actual name
• Artificial urgency: Deadlines, threats, "act now," "24 hours," "account will be deleted"
• Suspicious links: Buttons that don't link to official websites
• Vague details: No specific information about suspicious activity or claims
• Requests to click: Legitimate companies ask you to log in on their actual website, not click email buttons
• Grammar errors: Professional companies have polished writing; phishing emails often have mistakes
• Uncommon sender format: All-caps subject lines, unusual formatting, or unfamiliar email patterns
• Too good to be true: Prize notifications, refunds you didn't request, or unusual offers
• Unverified details: If you're not expecting a package, password reset, or claim, it's likely phishing

How to Verify Sender Identity

1. Check the full email address: Look at the complete sender address, not just the display name
2. Hover over links (desktop): Hover without clicking to see the actual URL destination
3. Check official website: Go directly to the company's official website (type in address bar) and compare
4. Contact the company directly: Call the number on their official website or use their official contact form
5. Look up the domain: Use WHOIS lookup to verify domain registration details
6. Check email headers: Advanced users can review email headers to trace the true origin

What to Do If You Clicked a Phishing Link

1. Do not enter your password or personal information
2. Close the browser tab or window immediately
3. If you already entered credentials, change your password immediately on the official website
4. Enable two-factor authentication to add an extra security layer
5. Monitor your account and credit reports for suspicious activity
6. Report the phishing email to the actual company and to the FTC at reportfraud.ftc.gov
7. Consider running antivirus software to check for malware

Phishing emails are designed to look legitimate and create panic. The best defense is to slow down and verify. Never click links in unsolicited emails—go directly to official websites instead. When in doubt, call the company using a number you find yourself (not from the email). Trust your instincts: if something feels off, it probably is.