Ultimate Comprehensive Guide to Email Phishing Examples and Variations

[Student]

Email phishing remains the primary vector for cyberattacks in 2025, accounting for over 90% of data breaches according to Verizon’s latest DBIR and billions in annual losses worldwide. Modern phishing is highly sophisticated: attackers use AI to craft flawless, personalized messages, leverage compromised legitimate accounts (to bypass spam filters), embed QR codes (quishing), exploit OAuth device codes to defeat MFA, and combine emails with follow-up smishing or vishing for multi-stage attacks.

Below is an expanded, detailed catalog of the most prevalent email phishing types active in late 2025, including exact subject lines, body text excerpts, attacker tactics, common variations, and precise red flags. All examples are based on real campaigns documented by security firms (Proofpoint, Barracuda, Cofense, KnowBe4, APWG, Huntress, and Microsoft Threat Intelligence) in 2025 reports.

1. Microsoft 365 / OAuth Device Code Phishing (The #1 most impersonated brand in 2025)​

Exploits the legitimate Microsoft device code authentication flow to steal credentials without triggering MFA prompts.

Common Subject Lines:

• "New sign-in to your Microsoft account"
• "Action required: Approve this device"
• "Microsoft Teams – New message notification"
• "Your OneDrive storage is almost full"

Typical Body Text Excerpts:

• "We noticed a sign-in from a new device. To continue, enter this code on your device: ABCD-1234-EFGH. Or approve here: [malicious link to fake login page]."
• "You have a new secure voicemail in Microsoft Teams. Click to listen: [link]."

Key Variations:

• Voicemail or document lures using HTML/SVG attachments that load phishing pages when opened.
• Calendar invite phishing: Auto-adds a meeting with a malicious link in the description.
• Personalized with victim’s name, company, or recent IP location (pulled from breaches).

Red Flags:

• Requests you to approve a device code or enter one manually.
• Sender domain is not @microsoft.com or @outlook.com (e.g., micros0ft-support.net).
• Urgency like “Approve within 10 minutes or access will be blocked.”

2. QR Code Phishing (Quishing) (Massive surge throughout 2025)​

Embeds QR codes in PDFs or images to bypass email link scanners.

Common Subject Lines:

• "New voicemail received"
• "Secure document requires your attention"
• "Package delivery update – scan to track"
• "Invoice attached – review and sign"

Typical Body Text Excerpts:

• "You have a new encrypted voicemail. Scan the QR code below using your mobile device to listen securely."
• "Please review the attached document and scan the QR code to confirm receipt."

Key Variations:

• Password-protected PDFs (password provided in email) containing the QR code.
• Multi-layered QR codes or ASCII-based codes for advanced evasion.
• Nested in seemingly legitimate Docusign or Adobe notifications.

Red Flags:

• Instructions to scan a QR code with your phone (especially for “secure” access).
• Attachments you weren’t expecting, even if the sender appears familiar.

3. Banking and Payment App Fraud Alerts​

Creates panic over alleged unauthorized transactions.

Common Subject Lines:

• "Security Alert: Unusual activity detected"
• "Confirm this transaction: $1,234.56 to Crypto.com"
• "Your card has been temporarily locked"

Typical Body Text Excerpts:

• "We’ve detected a suspicious purchase of $987 at an online retailer. If this wasn’t you, click here to secure your account immediately: [fake link]."

Key Variations:

• Zelle or Venmo “mistaken payment” requiring you to “return” funds.
• Requests for one-time passcodes sent to your phone.
• Impersonation of PayPal, Cash App, or Apple Pay.

Red Flags:

• Asks you to provide OTPs, passwords, or full card details.
• Links to domains that are not the official bank URL.

4. Business Email Compromise (BEC) / Fake Invoice Scams​

Targets employees with urgent payment requests.

Common Subject Lines:

• "Invoice #INV-2025-1234 Due Today"
• "Payment details update required"
• "Urgent: Wire transfer instructions"

Typical Body Text Excerpts:

• "Please find attached the updated invoice for services rendered. Kindly process payment by EOD to the new bank details provided."

Key Variations:

• CEO fraud: Spoofed executive email requesting gift cards or wire transfers.
• Vendor impersonation using thread hijacking (replying to real email chains).

Red Flags:

• Sudden changes in payment instructions.
• Slight misspellings in legitimate-looking domains.

5. Tech Support and Subscription Renewal Scams​

Fake auto-charges for services.

Common Subject Lines:

• "Thank you for your Norton renewal – $449.99"
• "Geek Squad Protection Plan Charged"
• "McAfee Subscription Auto-Renewed"

Typical Body Text Excerpts:

• "Your annual subscription has been renewed. If this was not authorized, contact us immediately at [fake number] or click here for refund."

Key Variations:

• Over-refund scam: “We accidentally charged too much – send the difference back via gift cards.”

Red Flags:

• Unsolicited confirmation of a charge you don’t recognize.
• Instructions to pay or refund via gift cards, crypto, or wire.

6. HR and Internal Company Impersonation​

Exploits workplace trust.

Common Subject Lines:

• "Updated payroll information required"
• "Confidential performance review attached"
• "New employee handbook – mandatory read"

Typical Body Text Excerpts:

• "Please review and acknowledge the updated schedule/policy by clicking here. – HR Department"

Key Variations:

• Fake bonus announcements or direct deposit updates.

7. Delivery, Government, and Prize Scams​

Common Subject Lines:

• "USPS: Package on hold – pay $3.99 fee"
• "IRS: You are eligible for a $4,821 refund"
• "Congratulations – Claim your $1,000 gift card"

Red Flags:

• Small fees or threats of penalties; promises of money for minimal action.

Universal Red Flags (Apply to All Phishing Emails)​

• Sender address mismatch: Hover over the display name – real sender is often a random domain.
• Suspicious links: Hover (don’t click) – URL doesn’t match the official domain (e.g., amazon-security.co instead of amazon.com).
• Unexpected urgency or threats: “Act within 24 hours or lose access.”
• Requests for sensitive information: Passwords, OTPs, SSN, full card numbers.
• Poor grammar or unnatural tone: Even AI-generated ones sometimes have subtle inconsistencies.
• Unexpected attachments or QR codes: Especially PDFs, ZIPs, or Office files with macros.

Phishing succeeds only when victims act hastily. By recognizing these exact patterns and pausing to verify, you can neutralize nearly every attempt. Stay skeptical, verify through official channels only, and report aggressively to help shut down campaigns faster.