================================================================================ PHISHING EMAIL SAMPLES — FOR AUTHORIZED SECURITY AWARENESS TRAINING ONLY ================================================================================ WARNING: These are fictional examples created for educational purposes. Using similar techniques against real targets without explicit written authorization is illegal. All domains use example.com or clearly fictional variants. ================================================================================ EMAIL #1 — CEO FRAUD / BUSINESS EMAIL COMPROMISE (BEC) Technique: Authority + Urgency + Secrecy ================================================================================ From: Marcus Webb Reply-To: marcus.webb.ceo@gmail.com To: jennifer.liu@acmecorp.com Date: Mon, 14 Oct 2025 08:12:33 -0400 Subject: Urgent — Confidential Acquisition Wire Transfer X-Mailer: Microsoft Outlook 16.0 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Jennifer, I need you to handle something urgently and confidentially. We are finalizing an acquisition that must close before end of business today. The board has approved the transaction but we cannot discuss it publicly until the deal is signed — insider trading regulations apply. Please wire $147,500 to the following account: Bank: First National Trust Routing: 021000089 Account: 4831-7720-5519 Beneficiary: Stratton Partners LLC Reference: ACQ-2025-CONF I am in back-to-back meetings and cannot take calls right now. Please confirm by reply once the transfer is complete. Do not discuss this with anyone else on the team until the announcement. Thanks for handling this quickly. Marcus Webb Chief Executive Officer Acme Corporation --- ANALYSIS NOTES --- Red flags: - From domain "acmec0rp.com" uses zero instead of 'o' (lookalike domain) - Reply-To is a personal Gmail address, not corporate email - Urgency: "must close before end of business today" - Secrecy: "do not discuss this with anyone else" - Authority: impersonates CEO - No phone verification requested — legitimate CFOs verify large transfers - Wire transfer to unfamiliar entity not in vendor system ================================================================================ EMAIL #2 — IT HELPDESK PASSWORD RESET Technique: Authority + Urgency + Social Proof ================================================================================ From: IT Security Team Reply-To: helpdesk-acme@outlook.com To: all-staff@acmecorp.com Date: Tue, 15 Oct 2025 14:30:11 -0400 Subject: [ACTION REQUIRED] Mandatory Password Reset — Security Incident X-Mailer: PHPMailer 6.8.0 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" ACME CORPORATION — IT SECURITY ALERT Due to a recent security incident, all employee passwords must be reset within the next 4 hours. Failure to comply will result in temporary account suspension. 85% of employees have already completed this mandatory reset. Please click the link below to verify your identity and create a new password: https://acmecorp-passwordreset.example.com/verify?user=employee You will need to enter: 1. Your current username 2. Your current password 3. Your new password If you have questions, reply to this email or call extension 4477. Thank you for your prompt attention to this matter. IT Security Team Acme Corporation --- ANALYSIS NOTES --- Red flags: - From domain "acmec0rp.com" — lookalike (zero for 'o') - Reply-To is an Outlook.com address, not internal - X-Mailer is PHPMailer — IT departments typically use Exchange/O365 - Social proof: "85% of employees have already completed" - Urgency: "within the next 4 hours" with threat of suspension - Asks for current password — legitimate resets never require this - Link domain "acmecorp-passwordreset.example.com" is not acmecorp.com - Sent to broad distribution list, not individualized ================================================================================ EMAIL #3 — INVOICE / PAYMENT REQUEST Technique: Authority + Commitment/Consistency ================================================================================ From: Sarah Chen Reply-To: sarah.chen.invoicing@protonmail.com To: accounts.payable@acmecorp.com Date: Wed, 16 Oct 2025 09:45:22 -0400 Subject: RE: Invoice #INV-2025-4891 — Updated Banking Details X-Mailer: Thunderbird 115.3.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_001" Hi Accounts Payable Team, Following up on our conversation last week regarding invoice #INV-2025-4891 for $23,750.00 (Q3 consulting services). Please note that we have recently changed our banking provider. Our updated payment details are: Bank: Metropolitan Commercial Bank Account Name: Vendor Partners International LLC Account Number: 8827-3340-1156 Routing Number: 026013673 Swift: MCBKUS33 Please update your records and process payment to the new account. The original invoice is attached for reference. Could you confirm receipt and expected payment date? Best regards, Sarah Chen Senior Accounts Manager Vendor Partners International Phone: +1 (555) 234-8891 www.vendorpartners-acme.example.com [Attachment: Invoice_INV-2025-4891.pdf.exe — 247 KB] --- ANALYSIS NOTES --- Red flags: - Domain "vendorpartners-acme.example.com" mimics vendor relationship - Reply-To is a Protonmail address (privacy-focused, hard to trace) - References a prior conversation that may not exist (commitment trap) - Banking detail change — #1 vector for payment fraud - Attachment has double extension: .pdf.exe (executable disguised as PDF) - No purchase order number referenced - Verification: should call known vendor contact on file, not reply ================================================================================ EMAIL #4 — PACKAGE DELIVERY NOTIFICATION Technique: Curiosity + Urgency ================================================================================ From: UPS Delivery Notification Reply-To: no-reply@ups-notifications.example.com To: david.park@acmecorp.com Date: Thu, 17 Oct 2025 11:22:08 -0400 Subject: UPS: Your package could not be delivered — Action Required X-Mailer: Postfix MTA MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" [UPS LOGO] Hello David Park, We attempted to deliver your package today but were unable to complete delivery. A signature is required. Tracking Number: 1Z999AA10123456784 Scheduled Delivery: October 17, 2025 Status: DELIVERY EXCEPTION — Address Verification Needed To reschedule delivery, please verify your shipping address and select a new delivery window: https://ups-redelivery.example.com/verify?track=1Z999AA10123456784 If no action is taken within 48 hours, your package will be returned to the sender. Thank you for choosing UPS. United Parcel Service www.ups.com --- ANALYSIS NOTES --- Red flags: - From domain "ups-notifications.example.com" is NOT ups.com - Legitimate UPS emails come from @ups.com or @upsemail.com - Link domain "ups-redelivery.example.com" is attacker-controlled - Uses target's real name (obtained via OSINT / data breach) - Urgency: 48-hour deadline before return to sender - Curiosity: recipient wonders "what package?" and clicks - X-Mailer is generic Postfix — UPS uses enterprise mail systems - Verification: check tracking number at ups.com directly ================================================================================ EMAIL #5 — URGENT SECURITY ALERT Technique: Fear + Authority + Urgency ================================================================================ From: Microsoft Account Security Reply-To: security-noreply@micros0ft-365.example.com To: rachel.torres@acmecorp.com Date: Fri, 18 Oct 2025 03:14:55 -0400 Subject: [ALERT] Unusual sign-in activity detected on your account X-Mailer: Amazon SES MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Microsoft Account Security Alert We detected unusual sign-in activity on your Microsoft 365 account. Date: October 18, 2025, 03:12 AM EDT Location: Moscow, Russia IP Address: 185.176.43.112 Device: Unknown Linux Device Status: SIGN-IN SUCCESSFUL If this was not you, your account may be compromised. Take immediate action to secure your account: https://login-microsoftonline.example.com/secure?session=aGVsbG8gd29ybGQ [SECURE MY ACCOUNT] If you do not take action within 1 hour, we will be forced to temporarily suspend your account to prevent further unauthorized access. Microsoft Account Protection Team Microsoft Corporation --- ANALYSIS NOTES --- Red flags: - From domain "micros0ft-365.example.com" — zero for 'o', not microsoft.com - Legitimate Microsoft alerts come from @accountprotection.microsoft.com - Link domain "login-microsoftonline.example.com" mimics microsoftonline.com - X-Mailer "Amazon SES" — Microsoft does not use AWS to send alerts - Sent at 3:14 AM — unusual for automated security systems to use local time - Fear: sign-in from Russia on unknown device - Urgency: "within 1 hour" suspension threat - Base64-like session parameter in URL (social engineering prop) - Verification: go directly to account.microsoft.com, never click email links ================================================================================ END OF SAMPLES ================================================================================