Phishing Emails: Real Examples and 7 Red Flags

Phishing emails are the most common kind of internet crime reported to the FBI. In its 2025 annual report, the FBI’s Internet Crime Complaint Center listed phishing and spoofing as the top crime type by number of complaints — 191,561 reports — and people 60 and older filed 48,064 of them.

The good news: almost every phishing email gives itself away with one or more of the same warning signs. Below are realistic examples of today’s most common phishing emails, followed by the seven red flags to look for.

What phishing is, in one sentence

The Federal Trade Commission explains it this way: scammers use email or text messages to trick you into giving them your personal and financial information — passwords, account numbers or your Social Security number. With that information, they can get into your email, bank or other accounts, or sell your information to other scammers.

Example 1: “Your payment was declined — your account is on hold”

This is one of the most common phishing stories. The FTC describes a classic example: an email that appears to be from a streaming service, with a generic greeting, a claim that your account is on hold because of a billing problem, and a link to update your payment details.

EXAMPLE — SCAM

Today 7:41 AM●●● ▮

From: Member Services <support@stream-billing.example.com>

Subject: Your membership is on hold

Dear Customer,

We’re having some trouble with your current billing information. We’ll try again, but in the meantime you may want to update your payment details.

UPDATE ACCOUNT NOW: https://stream-billing.example.com/update

If we can’t process your payment within 48 hours, your membership will be suspended.

Why it’s phishing: the FTC says legitimate companies won’t email you a link to update your payment information. If you are worried, open the company’s app or type its web address yourself and sign in there.

Example 2: The invoice you don’t recognize

Some phishing emails include an invoice or receipt for a purchase you never made. The goal is to alarm you into clicking or calling. A popular version is the fake security-software renewal: the FTC warns about texts and emails saying you were charged hundreds of dollars for a tech-support subscription, often using names like Geek Squad, McAfee or Norton. The FTC’s advice is direct: do not use the number included in the message.

EXAMPLE — SCAM

Yesterday 9:15 PM●●● ▮

From: Billing Desk <invoice@renewal-center.example.com>

Subject: Invoice #88-2190: Auto-renewal successful ($499.99)

Thank you for your purchase. Your 5-year device protection plan has been renewed and $499.99 will be charged to your account today.

If you did not authorize this renewal, call our refund desk within 24 hours at (888) 555-0119 to cancel and receive a full refund.

Why it’s phishing: it is a charge you don’t recognize, from an unexpected sender, with a deadline and a phone number. Check your real bank or card statement instead. If you call the number, the “refund desk” may ask to connect to your computer — the start of a tech support scam.

Example 3: The “suspicious login” security alert

Fake security alerts claim someone tried to sign in to your account, or that unusual activity was detected. The FTC lists “suspicious activity or log-in attempts” among the most common phishing stories.

EXAMPLE — SCAM

Today 5:58 AM●●● ▮

From: Security Team <no-reply@account-security.example.com>

Subject: Unusual sign-in attempt blocked

We detected an unusual sign-in attempt on your account from a new device.

If this wasn’t you, secure your account immediately by verifying your identity: https://account-security.example.com/verify

For your protection, your account will be locked if you do not verify within 12 hours.

Why it’s phishing: the link leads to a fake sign-in page built to capture your password. Real security alerts can be checked by opening the app or typing the website address yourself and reviewing your account’s recent activity.

Example 4: The government refund or official notice

Scammers also pretend to be government agencies. The FTC lists “you’re eligible for a government refund” as a common phishing lure. In February 2026 the Social Security Inspector General warned of a surge in fake Social Security “statement” emails that copy official branding and push people to download attachments that may install malware.

EXAMPLE — SCAM

Today 11:20 AM●●● ▮

From: Refund Department <refunds@federal-benefits.example.com>

Subject: You are eligible for a $1,284.00 government refund

Our records show you are eligible for an unclaimed refund of $1,284.00.

To receive your payment, confirm your Social Security number and bank account within 3 business days: https://federal-benefits.example.com/claim

Why it’s phishing: government agencies do not email you to ask for your Social Security number or bank details, and official Social Security emails come from addresses ending in .gov. See Social Security scams for more.

Example 5: The free gift or coupon

The FTC also lists offers of a coupon or free items as a common lure. These emails usually ask you to take a short survey and pay a small shipping fee — which is really a way to collect your card number.

EXAMPLE — SCAM

Today 1:33 PM●●● ▮

From: Customer Rewards <rewards@loyalty-gift.example.com>

Subject: Congratulations! Your loyalty reward is waiting

As a thank-you for being a loyal customer, you have been selected to receive a free premium blender. Just answer 3 quick questions and pay $4.95 shipping.

Claim your reward: https://loyalty-gift.example.com

Example 6: The blackmail email with your old password

Some scam emails claim the sender hacked your computer and recorded you, and threaten to share the video unless you pay in Bitcoin. To seem believable, they may include one of your real old — or recent — passwords, probably taken from a data breach. The FTC’s advice: don’t pay anything, delete the message, and update that password (and consider whether other passwords need changing too).

The 7 red flags of a phishing email

Look for these warning signs, drawn from the FTC, CISA and Apple’s guidance. One red flag is enough reason to stop and check.

1. It’s unexpected — or from a company you don’t use. The FTC’s first question: do I have an account with this company, or do I know the person who contacted me? If not, it could be phishing.
2. Urgent or emotional language. CISA warns about messages that claim dire consequences if you don’t respond immediately.
3. A request for personal or financial information. Passwords, account numbers, your Social Security number, card details.
4. A link to “update,” “verify” or “confirm.” Especially a link to update payment details — which, the FTC says, legitimate companies won’t email you.
5. An address or link that doesn’t match. CISA gives the example of a look-alike address such as “amazan.com.” Apple adds: the sender’s address or phone number doesn’t match the company, or the link’s web address doesn’t match the company’s real website.
6. A generic greeting. “Dear Customer” or “Dear Member” instead of your name.
7. An unexpected attachment or invoice. Attachments can install harmful software; invoices you don’t recognize are designed to alarm you.

Two things that are not proof an email is real: a real company logo (the FTC says that doesn’t prove legitimacy) and perfect spelling and grammar (CISA says AI can now produce flawless messages).

What to do with a suspicious email

• Don’t click, open or reply. CISA’s advice is to resist the temptation to click links or attachments and simply delete the message — don’t even click “unsubscribe.”
• Check the account yourself. If you do have an account with the company, contact it using a phone number or website you know is real.
• Report it. Use your email’s Report phishing button, forward the email to reportphishing@apwg.org, and report it at ReportFraud.ftc.gov. Our step-by-step guide shows how to report a phishing email.

Protect yourself before the next one arrives

The FTC recommends four layers of protection:

1. Use security software and set it to update automatically.
2. Keep your phone’s software up to date automatically.
3. Turn on multi-factor authentication for your important accounts, so a stolen password alone isn’t enough.
4. Back up your data to an external hard drive or the cloud.

If you already clicked or replied

If you entered a password, change it right away — and anywhere else you used it. If you shared card, bank or Social Security information, go to IdentityTheft.gov and contact your bank. If you clicked a link that may have installed software, update your security software, run a scan and remove anything it flags. Our first-hour checklist walks you through it.

Want the basics first? Read what is phishing? And if someone is sending emails that look like they come from you, see is a scammer using your email address?