Phishing email examples, and how to train your staff to spot them
By Jera IT
Originally published May 2023. Refreshed November 2026: AI now writes phishing emails with perfect spelling and attackers have moved onto QR codes, Teams and cloned voices, so 'look for typos' no longer works. We've rewritten this guide around what phishing looks like today.
Phishing is still, by far, the most common breach or attack UK businesses report (Cyber Security Breaches Survey 2025/26), and it has got much harder to spot. The emails are now well written and arrive through channels people trust. Staff who know what to look for catch what the filters miss.
The short answer: a phishing email pretends to be someone you trust to get you to pay or log in. Today the clues are pressure and details that don’t match, not bad spelling. Train staff little and often, and make reporting easy.
Phishing email examples businesses see today
- “Your password expires today.” Looks like Microsoft 365, with a button to “keep your password”. It leads to a perfect copy of the Microsoft login page.
- The fake invoice. A supplier you really use “has changed bank details”. The email may even come from the supplier’s real account, after they were hacked.
- The urgent request from the boss. “Are you free? I need you to buy some gift cards for a client, I’m in a meeting.” Short, urgent, unusual.
- “A document has been shared with you.” A file-sharing notification that asks you to sign in to view it.
- The parcel delivery. “We tried to deliver your package. Pay a small fee to rebook.” Common by text too.
- The QR code. A PDF or email asking you to scan a code to “re-authenticate” or “view your payslip”, which moves the attack onto your phone, outside your work protections.
- The fake IT helpdesk. A Teams message or phone call from “IT support” asking you to approve a sign-in prompt or install remote-access software.
- The cloned voice. A voicemail or call that sounds like a senior manager asking for an urgent payment. AI voice cloning makes this possible from a few seconds of audio.
The warning signs
- Urgency or pressure: “today”, “immediately”, “before your account is closed”.
- An unusual request: payments, gift cards, changed bank details, sharing a login or an authentication code.
- Mismatched details: hover over a link and the address doesn’t match; the sender’s address is slightly off.
- Asking you to sign in after clicking a link in a message.
- Going around normal process: “don’t tell anyone”, “just this once”.
What no longer works: looking for spelling mistakes. AI writes clean, convincing English.
The golden rule: if a message asks for money, a login or a change of details, check it by contacting the person or company using details you already have, not the ones in the message.
How to run phishing training that works
- Little and often. Short, regular lessons beat one long annual session.
- Simulated phishing. Realistic test emails show who falls for what, and give people practice in a safe setting.
- No blame. If people fear getting into trouble, they hide mistakes. Thank them for reporting, even if they clicked first.
- Make reporting one click. A “report phishing” button in Outlook means suspicious emails reach IT quickly.
- Cover every channel. Include texts, Teams messages, QR codes and phone calls as well as email.
- Start on day one. New starters don’t yet know what a normal request looks like.
Back it up with technology
Training reduces risk; it doesn’t remove it. Pair it with:
- Multi-factor authentication. Put it on every account, ideally phishing-resistant methods like passkeys.
- Email filtering. It checks links and attachments before they arrive.
- A password manager. It won’t fill in your password on a fake site. See password manager vs paper.
- Clear payment rules. Confirm every bank detail change by phone, using a number you already hold.
Where an AI agent helps
Training is the human layer; these agents add a safety net behind it:
- AI Payment-Verification Agent ↗: verifies bank details and flags suspicious invoices before money moves.
- AI Security-Monitoring Agent ↗: watches for suspicious activity around the clock if someone does click.
See all our agents in the solutions library on jerait.ai ↗, or find the right agent for your business on jerait.ai ↗.
The catch: the AI an agent runs on is paid for by use. With Jera IT support, your first agent is built, supported and maintained free; we give you a rough idea of the usage cost before you commit, and a real figure from the trial.
How Jera can help
We set up the email filtering, multi-factor authentication and reporting that back your training up, for teams across Edinburgh, Glasgow and Aberdeenshire, as part of our cyber security work. If someone has already clicked, contact us straight away.
Frequently asked questions
What is an example of a phishing email?
A common one is a message that looks like Microsoft 365 saying your password expires today, with a button to 'keep your password'. The link goes to a fake login page that steals your details. Others include fake invoices, parcel delivery notices, shared-document alerts and urgent payment requests that appear to come from your boss.
How can you tell if an email is phishing?
Look for pressure to act quickly, a request that's unusual for that sender, a sender address or link that doesn't match the organisation, and requests for logins, payments or gift cards. If in doubt, check by contacting the person or company using details you already have, not the ones in the message.
How often should staff have phishing training?
Little and often works best: short training a few times a year, plus regular simulated phishing emails, rather than one long session annually. Train new starters in their first week.
Where do I report a phishing email in the UK?
Forward suspicious emails to report@phishing.gov.uk, run by the National Cyber Security Centre, and suspicious texts to 7726. Inside your business, use your 'report phishing' button or tell IT straight away, especially if someone has clicked or entered details.
Does phishing training actually work?
Yes, when it's ongoing and blame-free. The goal isn't that nobody ever clicks; it's that people recognise the signs more often and report quickly, so IT can act before damage is done.
Sources
- Cyber security breaches survey 2025/2026, GOV.UK (Department for Science, Innovation and Technology)
- Report a scam email, National Cyber Security Centre
