Phishing email examples: 10 real cases analysed

The most widespread phishing emails today imitate services we use every day: the company mailbox, PEC, a payment to settle, a shared document, a subscription. In Italy, in 2025, CERT-AgID recorded 1,922 phishing campaigns involving 153 different brands, with fake PagoPA fines in first place. Globally, according to Check Point’s Brand Phishing Report for the second quarter of 2026, Microsoft is the most imitated brand, accounting for 23% of attempts.

To raise awareness of this practice and offer more informed ways of reading suspicious messages, we have collected ten examples of phishing emails drawn from real, documented campaigns. For each one we set out who the sender pretends to be, what they ask for, where the trap lies and the detail that gives it away. The subject lines shown are typical: campaigns change them constantly, but the pattern stays the same. To learn more about this practice and how to check any suspicious message, we recommend reading our article on Phishing.

Ten examples of phishing emails, one by one

1. The expiring mailbox password

• Who it pretends to be: Microsoft 365, Outlook or the company webmail administrator.
• Typical subject: “Your password expires today”, “Mailbox almost full: incoming messages suspended”.
• What it asks for: to click to “keep your current password” or free up space.
• The trap: a login page identical to Microsoft’s, which records email addresses and passwords. More advanced versions also intercept the verification code and hijack the session that is already open.
• The detail that gives it away: the page address is not a Microsoft domain, and no genuine service asks you to confirm a password to stop it expiring.

It is one of the most common examples in companies, because access to the mailbox opens the door to almost everything else.

2. The fake invoice via PEC

• Who it pretends to be: the Agenzia delle Entrate or a supplier, writing from a certified email (PEC) address.
• Typical subject: “E-invoice pending”, “Tax document to download”.
• What it asks: to open the attachment or download the document from a computer, “because the smartphone version is still in development”.
• The trap: in the campaign reported by the Agenzia delle Entrate in June 2026, the attachment is a compressed archive containing an HTML file which, when opened on Windows, launches a script capable of compromising the computer and stealing credentials.
• The detail that gives it away: a genuine tax document never arrives as an archive with a web page inside, and the request to use “only a PC” is meant to get around the best-protected systems.

PEC is no guarantee: it certifies that a message was sent, not that the sender is honest. According to CERT-AgID, there were 77 phishing campaigns via PEC in 2025, around 80% more than the previous year.

3. The fine to pay via PagoPA

• Who it pretends to be: PagoPA, a local police force or a collection agency.
• Typical subject line: “Payment notice for a Highway Code violation”.
• What it asks for: to pay a small fine immediately to avoid surcharges.
• The trap: a fake payment portal that harvests personal and card details.
• The detail that gives it away: fines are served by registered post, the authority’s PEC or the IO app, not through a generic link; and the low amount is chosen deliberately to discourage second thoughts.

In 2025 CERT-AgID counted 328 PagoPA-themed campaigns based on fake traffic fines: it was the most exploited theme of the year in Italy.

4. The shared document

• Who it pretends to be: Google Docs, SharePoint, OneDrive or an e-signature service such as DocuSign, often in the name of a real colleague or client.
• Typical subject: “A document has been shared with you”, “Contract awaiting signature”.
• What it asks: to open the document.
• The trap: the page asks you to sign in with your company account before showing the file, or to authorise an application that gains access to your mailbox. In 2017 a campaign in the name of Google Docs spread in exactly this way, asking users to authorise a fake app.
• The giveaway: a document you were not expecting, a login request where you are usually already signed in, an app asking to read and send email.

5. The urgent request from the boss or a supplier

• Who it pretends to be: the chief executive, the finance director or a regular supplier.
• Typical subject line: “Urgent and confidential”, “Bank details update”.
• What it asks: to make a bank transfer today or register a new IBAN for future payments.
• The trap: there is no link or attachment, so filters often fail to stop it. The deception lies entirely in the text.
• The detail that gives it away: a domain almost identical to the real one, a request not to involve other colleagues, a deadline that prevents any verification.

This is the typical pattern of spear phishing and BEC fraud, the most costly for companies.

6. The renewed subscription “to cancel by phone”

• Who it pretends to be: an antivirus, a streaming service, a marketplace or a software provider.
• Typical subject line: “Confirmation of your subscription renewal”, “Order no. … charged”.
• What it asks: to call a support number if you do not recognise the charge, often a few hundred euros.
• The trap: the email contains no links or attachments, only a phone number. On the phone, a fake operator guides the victim into installing a remote-control program or handing over card details “for the refund”. This is the technique known as TOAD, a telephone-oriented attack.
• The detail that gives it away: a subscription you never took out and a number that does not appear on the service’s official website.

7. The QR code to scan

• Who it pretends to be: the company IT department or Microsoft.
• Typical subject line: “Update your two-factor authentication within 24 hours”.
• What it asks: to scan a QR code with your smartphone to “reconfigure” the account’s security.
• The trap: the QR code leads to a fake login page. By moving the action from the computer to the phone, the fraudster bypasses corporate email filters and link checks, which are harder on a smartphone.
• The detail that gives it away: no IT department asks you to manage account security by scanning a code received by email.

8. The failed subscription payment

• Who it pretends to be: a subscription-based digital service, from streaming platforms to artificial intelligence tools. In the second quarter of 2026, ChatGPT entered the top 10 most impersonated brands for the first time, according to Check Point.
• Typical subject: “Payment problem: your account will be suspended”.
• What it asks: to update the payment method.
• The trap: a page that imitates the billing page and harvests card details.
• The giveaway: the notice does not appear when you access the service through the app or by typing the website address yourself.

9. The reply within a real conversation

• Who it pretends to be: a colleague, client or supplier you are genuinely corresponding with.
• Typical subject: the same as an ongoing conversation, preceded by “Re:”.
• What it asks: to open “the updated version” of a document or invoice.
• The trap: the fraudster has access to a compromised mailbox, or copies a genuine email and resends it with the attachment swapped. This is known as clone phishing, and it works because it arrives in the right context.
• The detail that gives it away: a tone slightly different from usual, an attachment in an unusual format, a request that nobody in the thread had mentioned.

10. The fake “I’m not a robot” check

• Who it pretends to be: any service, as long as the email leads to a page with a fake CAPTCHA.
• Typical subject line: a delivery notification, a document to view, a security alert.
• What it asks for: on the page, to “verify you are human” by pressing a key combination and pasting text into the computer’s Run window.
• The trap: the copied text is a command that installs malware. This is the ClickFix technique, which grew sharply in 2025 according to CERT-AgID, and it is the victim who launches it.
• The giveaway: no legitimate anti-robot check asks you to open system windows or paste commands.

What all phishing emails have in common

Placed side by side, the ten cases show that recognising a phishing email is not about looking for typos. The recurring elements are different:

1. A service you actually use. Effective phishing emails do not imitate random brands, but those that feature in your day: company email, PEC certified email, payments, shared documents.
2. An event that demands a reaction. A deadline, a charge, a suspension, a pending document: something always “happens” if you do not act.
3. An action moved outside the normal channel. Clicking a link instead of opening the app, calling a number given in the message, scanning a QR code, pasting a command, using the computer instead of the phone.
4. A step that bypasses the controls. No link, when filters check links; a compressed archive, when they block attachments; the phone, when email is protected.
5. A single, genuinely dangerous request. Entering credentials, paying, authorising an app, changing an IBAN. Everything else in the email serves only to make that moment credible.

Grammatical errors and blurry logos, which many guides still cite as the main warning sign, are becoming rarer: with artificial intelligence, messages are written in correct Italian and carefully laid out. The check that never loses its value remains the same: verify the real sender and where links lead, and never use the contact details given in the message.

How to use these examples to train the team

For a company, a collection of phishing email examples is most valuable as training material. It works best if it meets three criteria:

• Examples close to the company’s reality. Finance staff need to see fake invoices and requests to change IBAN details; those who run the systems, fake Microsoft alerts and shared documents; everyone, the PEC and PagoPA cases.
• Up-to-date examples. Campaigns change every month: it pays to collect suspicious messages actually received and reported by colleagues, removing personal data, and use them instead of generic examples.

Examples linked to a practical test. Showing a case and then measuring the response with a simulation makes training concrete. Tools and metrics are described in the guide to anti-phishing tests and methods.