ISO 27001 Certified badge by A-LIGNNewsWhalemate is ISO/IEC 27001:2022 certifiedSee Trust Center
Phishing examples

Annotated phishing examples: how to recognize each scam

Six phishing attack examples that reach companies and people, recreated with fictitious data and with every red flag marked on the piece: email, SMS, QR code and phone call. Each example explains what to do if you get one and how it changes on other channels.

Simulate these scenarios with your team
Phishing examples

Pick an example

Grouped by the channel they arrive through.

Email

Fake overdue invoice

An attachment that looks like a PDF and opens a page asking for your password.

See the annotated example
Email

Fake Microsoft 365 alert

“Your password expires today” and a button to keep it that leads to a fake sign-in page.

See the annotated example
Email

Urgent CEO wire transfer

A rushed, confidential request from an address that is not the CEO’s.

See the annotated example
SMS

Package on hold text

A tiny shipping fee and a link to pay it before the package is returned.

See the annotated example
QR code

Fake parking QR code

A sticker on the parking meter that leads to a card payment page.

See the annotated example
Phone call

Bank alert and fake call

A text about a purchase you did not make and a call from the “fraud team” asking for a code.

See the annotated example
Red flags

The red flags that keep coming back

The pretext and the channel change, but these six red flags show up again and again.

Urgency or a threat

A deadline of hours, a fine, a service cut or a locked account. Urgency exists so you do not verify.

A sender that does not match

The display name is someone you know; the address, number or domain is not. Always look at the full sender.

A request outside the process

Paying into a new account, skipping an approval, signing in to see a document. If the request breaks the usual workflow, stop.

A destination that is not what it seems

In a link, the domain that counts is the one right before the first slash. With a QR code, the camera shows the address before you open it.

They ask for a secret

Passwords, verification codes, full card details. No legitimate sender asks for them by email, by text or on a call you did not start.

They stop you from verifying

Confidentiality, “I cannot take calls”, “do not hang up”. When someone asks you not to check, check.

Before you respond

If you get one of these

  • Do not click, do not scan and do not reply.
  • Verify on a channel you already know: the number on the back of your card, the usual portal, the person’s extension.
  • Report it to security even if you already deleted it: an early report protects the rest of the company.
  • If you already fell for it, speak up right away. Changing a password or blocking a card in time changes the outcome.
Frequently asked questions

Questions about phishing examples

What are some real examples of phishing?
Six patterns that reach companies: the fake overdue invoice with an attachment that steals the email password, the notice that your Microsoft 365 password expires today, the urgent and confidential request to wire money in the CEO’s name, the QR code stuck on a parking meter, the text about a package on hold and the call from the bank’s fake “fraud team”. Each one is recreated with fictitious data and its red flags marked.
What is an example of phishing?
It is a message that poses as someone you trust —a supplier, IT, an executive, a bank— so you do something the attacker needs: hand over a password, pay, transfer money or install something. The channel changes (email, SMS, QR, phone call), but the pattern repeats: urgency, an unusual request and a destination that is not what it seems.
What are the most common types of phishing?
By channel: email phishing, smishing (SMS and messaging apps), QRishing or quishing (QR codes) and vishing (voice). By goal: credential theft, like the fake Microsoft 365 alert; payment fraud, like the fake invoice or CEO fraud; and card fraud, like the parking QR code or the package on hold text.
How do you spot a phishing email?
Look at the sender’s full address, not just the name, check where the link goes before opening it and read the domain right before the first slash. Be wary of urgency and of any request for a password, code or payment outside the usual process. If in doubt, verify on a channel you already know.
What should I do if I already clicked or gave my details?
Tell security or IT right away, even if it feels embarrassing. Change your password from the usual portal, ask them to sign out open sessions and, if you paid or gave card details, call your bank on its official number to stop the transaction.
How do you train a team to recognize them?
With practice on the same scams that are circulating, not only with a course. Whalemate simulates email and QR phishing natively, and smishing and vishing as a professional service; every fail triggers short training on the red flag the person missed, and the analytics show who concentrates the risk.

Definitions in the glossary:PhishingSmishingVishingQRishingSocial engineering

Would your team recognize these scams?

With Whalemate your team practices with simulations: email and QR natively, SMS and voice as a professional service. Every fail triggers training on the red flag that was missed, and the analytics show who concentrates the risk.

Simulate these scenarios with your team