untrappable.Check

Phishing email examples: 7 illustrations, annotated

Yes — this is a scam. Phishing emails often copy familiar senders and use urgency, attachments, or links to obtain information. These examples show warning signs, not an exhaustive test.

Exhibit · Email

Invoice #INV-4471 — payment of $649.99 confirmed
P
PayPal Service
service@paypa1-billing[.]com
9:14 AM
We've charged your account $649.99 for a Norton 360 subscription renewal. If you did not authorize this, cancel within 24 hours to avoid the charge: paypa1-secure[.]com/cancel
Cancel this payment
Exhibit 2Amazon “order confirmation”
Your order of $1,299.00 has been placed
A
Amazon Orders
auto-confirm@amazon-orders[.]info
8:52 AM
Thank you for your order of an Apple iPhone (1,299.00). If you did not place this order, cancel it within 24 hours here: amazon-orders[.]info/cancel
Cancel order
Exhibit 3Microsoft “password expires today”
Your password expires today — action required
M
Microsoft Account Team
account-security@micros0ft-support[.]com
7:30 AM
Your Microsoft 365 password expires today. To keep your mailbox active, verify your account now: micros0ft-support[.]com/verify
Keep my password
Exhibit 4Netflix “payment declined”
Your membership is on hold — update payment
N
Netflix
billing@netflix-account[.]info
6:05 PM
We couldn't process your last payment, so your membership is on hold. Update your billing details to avoid cancellation: netflix-account[.]info/billing
Update payment
Exhibit 5DocuSign “document to sign”
You have a document waiting for signature
D
DocuSign
dse@docusign-secure[.]net
10:41 AM
A document has been sent to you to review and sign. Please review and act on this document: docusign-secure[.]net/review
Review Document
Exhibit 6IRS “tax refund”
You are eligible for a refund of $978.42
I
IRS Refund Center
refund@irs-gov[.]online
2:18 PM
After the last calculation of your fiscal activity, you are eligible to receive a tax refund of $978.42. Submit your refund request: irs-gov[.]online/refund
Claim refund
Exhibit 7Geek Squad “auto-renewal receipt”
Your Geek Squad protection has been renewed — $399.99
G
Geek Squad
billing@geeksquad-renewal[.]com
11:07 AM
Your annual Geek Squad protection plan was auto-renewed for $399.99. If you wish to cancel this charge, call our billing team at +1 (888) 555-0143 within 24 hours.

Other versions you might get: The brands change — your bank, a delivery company, a crypto exchange — but the four moves stay the same: a look-alike sender, an alarming or too-good subject, a deadline, and a link that goes somewhere other than where it claims.

What to do right now

  1. Don't click any link, open attachments, or call a number in the email.
  2. Check independently. Open the service’s app or official site yourself and contact its support if the claim is unclear. A missing account notice does not by itself settle authenticity.
  3. If you already interacted: use the exposure-specific recovery steps. If you suspect a harmful download, update security software, scan, and remove detected threats. Opening alone is not proof of safety or compromise.
  4. Report it. Forward the email to the impersonated company's phishing address (e.g. phishing@paypal.com) and to reportphishing@apwg.org, then file at reportfraud.ftc.gov.
  5. Delete it, and mark it as phishing so your inbox filters the next one.

Reduce the risk of another scam

Reading an email is generally less risky than entering credentials or running a download, but it is not a guarantee of safety. Do not open unverified attachments, grant permissions, or follow its links. If you downloaded something or suspect malware, update security software and scan; if you entered details, secure those accounts through official routes.

● Public service · free steps first

Take the free protection steps first

A suspicious message does not tell us how someone found your details. If you shared personal information, start with the official recovery guidance. You can also freeze your credit for free.

Decide what protection you need

Start with the free controls above. Compare what a paid service would add only after deciding which problem remains.

Frequently asked

What does a phishing email look like?
These seven illustrations show look-alike senders, unexpected bills, urgent requests and misleading links. They are examples of warning signs, not actual intercepted messages or a complete detection test. Verify an unexpected request through a known contact route.
How can I tell a real email from a phishing one?
A sender name, logo or deadline does not authenticate an email. Contact the organization through a phone number or website you already know is real, not the details in the message, and ask about the specific request.
What should I do if I clicked a link in a phishing email?
Close the page and use the clicked-only recovery section. If you suspect a harmful download, update security software, scan and remove detected threats. If information was entered, autofilled or access was granted, follow those exposure steps too.
How do I report a phishing email?
Forward it to the impersonated company's phishing address (like phishing@paypal.com or phishing@irs.gov), and to the Anti-Phishing Working Group at reportphishing@apwg.org. Report it to the FTC at reportfraud.ftc.gov, then delete it and mark it as phishing. CISA's Recognize and Report Phishing has more.

Sources

  1. 01How to recognize and avoid phishing scams— Federal Trade Commission
  2. 02Recognize and Report Phishing— CISA
  3. 03How to recognize and report spam text messages— Federal Trade Commission
  4. 04Internet Crime Complaint Center (IC3)— FBI

Pass it on

Help protect someone else

If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. It's safe to forward, and stands on its own as a record for a bank or the police.