================================================================================
PHISHING EMAIL SAMPLES — FOR AUTHORIZED SECURITY AWARENESS TRAINING ONLY
================================================================================

WARNING: These are fictional examples created for educational purposes. Using
similar techniques against real targets without explicit written authorization
is illegal. All domains use example.com or clearly fictional variants.

================================================================================
EMAIL #1 — CEO FRAUD / BUSINESS EMAIL COMPROMISE (BEC)
Technique: Authority + Urgency + Secrecy
================================================================================

From: Marcus Webb <marcus.webb@acmec0rp.com>
Reply-To: marcus.webb.ceo@gmail.com
To: jennifer.liu@acmecorp.com
Date: Mon, 14 Oct 2025 08:12:33 -0400
Subject: Urgent — Confidential Acquisition Wire Transfer
X-Mailer: Microsoft Outlook 16.0
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"

Jennifer,

I need you to handle something urgently and confidentially. We are finalizing
an acquisition that must close before end of business today. The board has
approved the transaction but we cannot discuss it publicly until the deal is
signed — insider trading regulations apply.

Please wire $147,500 to the following account:

  Bank: First National Trust
  Routing: 021000089
  Account: 4831-7720-5519
  Beneficiary: Stratton Partners LLC
  Reference: ACQ-2025-CONF

I am in back-to-back meetings and cannot take calls right now. Please confirm
by reply once the transfer is complete. Do not discuss this with anyone else
on the team until the announcement.

Thanks for handling this quickly.

Marcus Webb
Chief Executive Officer
Acme Corporation

--- ANALYSIS NOTES ---
Red flags:
  - From domain "acmec0rp.com" uses zero instead of 'o' (lookalike domain)
  - Reply-To is a personal Gmail address, not corporate email
  - Urgency: "must close before end of business today"
  - Secrecy: "do not discuss this with anyone else"
  - Authority: impersonates CEO
  - No phone verification requested — legitimate CFOs verify large transfers
  - Wire transfer to unfamiliar entity not in vendor system

================================================================================
EMAIL #2 — IT HELPDESK PASSWORD RESET
Technique: Authority + Urgency + Social Proof
================================================================================

From: IT Security Team <security@acmec0rp.com>
Reply-To: helpdesk-acme@outlook.com
To: all-staff@acmecorp.com
Date: Tue, 15 Oct 2025 14:30:11 -0400
Subject: [ACTION REQUIRED] Mandatory Password Reset — Security Incident
X-Mailer: PHPMailer 6.8.0
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"

ACME CORPORATION — IT SECURITY ALERT

Due to a recent security incident, all employee passwords must be reset
within the next 4 hours. Failure to comply will result in temporary
account suspension.

85% of employees have already completed this mandatory reset.

Please click the link below to verify your identity and create a new
password:

  https://acmecorp-passwordreset.example.com/verify?user=employee

You will need to enter:
  1. Your current username
  2. Your current password
  3. Your new password

If you have questions, reply to this email or call extension 4477.

Thank you for your prompt attention to this matter.

IT Security Team
Acme Corporation

--- ANALYSIS NOTES ---
Red flags:
  - From domain "acmec0rp.com" — lookalike (zero for 'o')
  - Reply-To is an Outlook.com address, not internal
  - X-Mailer is PHPMailer — IT departments typically use Exchange/O365
  - Social proof: "85% of employees have already completed"
  - Urgency: "within the next 4 hours" with threat of suspension
  - Asks for current password — legitimate resets never require this
  - Link domain "acmecorp-passwordreset.example.com" is not acmecorp.com
  - Sent to broad distribution list, not individualized

================================================================================
EMAIL #3 — INVOICE / PAYMENT REQUEST
Technique: Authority + Commitment/Consistency
================================================================================

From: Sarah Chen <accounts@vendorpartners-acme.example.com>
Reply-To: sarah.chen.invoicing@protonmail.com
To: accounts.payable@acmecorp.com
Date: Wed, 16 Oct 2025 09:45:22 -0400
Subject: RE: Invoice #INV-2025-4891 — Updated Banking Details
X-Mailer: Thunderbird 115.3.1
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_001"

Hi Accounts Payable Team,

Following up on our conversation last week regarding invoice #INV-2025-4891
for $23,750.00 (Q3 consulting services).

Please note that we have recently changed our banking provider. Our updated
payment details are:

  Bank: Metropolitan Commercial Bank
  Account Name: Vendor Partners International LLC
  Account Number: 8827-3340-1156
  Routing Number: 026013673
  Swift: MCBKUS33

Please update your records and process payment to the new account. The
original invoice is attached for reference.

Could you confirm receipt and expected payment date?

Best regards,
Sarah Chen
Senior Accounts Manager
Vendor Partners International
Phone: +1 (555) 234-8891
www.vendorpartners-acme.example.com

[Attachment: Invoice_INV-2025-4891.pdf.exe — 247 KB]

--- ANALYSIS NOTES ---
Red flags:
  - Domain "vendorpartners-acme.example.com" mimics vendor relationship
  - Reply-To is a Protonmail address (privacy-focused, hard to trace)
  - References a prior conversation that may not exist (commitment trap)
  - Banking detail change — #1 vector for payment fraud
  - Attachment has double extension: .pdf.exe (executable disguised as PDF)
  - No purchase order number referenced
  - Verification: should call known vendor contact on file, not reply

================================================================================
EMAIL #4 — PACKAGE DELIVERY NOTIFICATION
Technique: Curiosity + Urgency
================================================================================

From: UPS Delivery Notification <tracking@ups-notifications.example.com>
Reply-To: no-reply@ups-notifications.example.com
To: david.park@acmecorp.com
Date: Thu, 17 Oct 2025 11:22:08 -0400
Subject: UPS: Your package could not be delivered — Action Required
X-Mailer: Postfix MTA
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"

[UPS LOGO]

Hello David Park,

We attempted to deliver your package today but were unable to complete
delivery. A signature is required.

  Tracking Number: 1Z999AA10123456784
  Scheduled Delivery: October 17, 2025
  Status: DELIVERY EXCEPTION — Address Verification Needed

To reschedule delivery, please verify your shipping address and select
a new delivery window:

  https://ups-redelivery.example.com/verify?track=1Z999AA10123456784

If no action is taken within 48 hours, your package will be returned
to the sender.

Thank you for choosing UPS.

United Parcel Service
www.ups.com

--- ANALYSIS NOTES ---
Red flags:
  - From domain "ups-notifications.example.com" is NOT ups.com
  - Legitimate UPS emails come from @ups.com or @upsemail.com
  - Link domain "ups-redelivery.example.com" is attacker-controlled
  - Uses target's real name (obtained via OSINT / data breach)
  - Urgency: 48-hour deadline before return to sender
  - Curiosity: recipient wonders "what package?" and clicks
  - X-Mailer is generic Postfix — UPS uses enterprise mail systems
  - Verification: check tracking number at ups.com directly

================================================================================
EMAIL #5 — URGENT SECURITY ALERT
Technique: Fear + Authority + Urgency
================================================================================

From: Microsoft Account Security <security-alert@micros0ft-365.example.com>
Reply-To: security-noreply@micros0ft-365.example.com
To: rachel.torres@acmecorp.com
Date: Fri, 18 Oct 2025 03:14:55 -0400
Subject: [ALERT] Unusual sign-in activity detected on your account
X-Mailer: Amazon SES
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"

Microsoft Account Security Alert

We detected unusual sign-in activity on your Microsoft 365 account.

  Date: October 18, 2025, 03:12 AM EDT
  Location: Moscow, Russia
  IP Address: 185.176.43.112
  Device: Unknown Linux Device
  Status: SIGN-IN SUCCESSFUL

If this was not you, your account may be compromised. Take immediate
action to secure your account:

  https://login-microsoftonline.example.com/secure?session=aGVsbG8gd29ybGQ

  [SECURE MY ACCOUNT]

If you do not take action within 1 hour, we will be forced to
temporarily suspend your account to prevent further unauthorized access.

Microsoft Account Protection Team
Microsoft Corporation

--- ANALYSIS NOTES ---
Red flags:
  - From domain "micros0ft-365.example.com" — zero for 'o', not microsoft.com
  - Legitimate Microsoft alerts come from @accountprotection.microsoft.com
  - Link domain "login-microsoftonline.example.com" mimics microsoftonline.com
  - X-Mailer "Amazon SES" — Microsoft does not use AWS to send alerts
  - Sent at 3:14 AM — unusual for automated security systems to use local time
  - Fear: sign-in from Russia on unknown device
  - Urgency: "within 1 hour" suspension threat
  - Base64-like session parameter in URL (social engineering prop)
  - Verification: go directly to account.microsoft.com, never click email links

================================================================================
END OF SAMPLES
================================================================================
