Guide
May 2026
· 4 min read
The 5 Phishing Emails Your Team Will Fall For (and How to Train Against Them)
Phishing is still the entry point for over 80% of SMB breaches. These aren't the obvious "Nigerian prince" emails — they're well-crafted, contextually plausible, and designed to create urgency. Here are the five types that consistently fool business teams, with the red flags to teach.
The 5 phishing emails
From:accounts@acme-supplies.co (spoofed)
To:finance@yourcompany.com
Subject:Invoice #INV-2847 — Payment due 15 Sept
Hi,
Please find attached invoice #INV-2847 for €3,240.00, due 15 September. Note that we've updated our bank details — please use the new account for this and future payments.
New bank details are in the attached PDF.
Thanks,
Accounts Team, Acme Supplies
Invoice_INV2847.pdf.exe
Red flags to teach
- Request to change bank details — always verify by phone to a known number, never by replying to the email
- File extension ending in .exe disguised as a PDF
- Sender domain looks right but is slightly different (acme-supplies.co vs acme-supplies.com)
- Urgency created by a due date
From:security-alert@microsoft-accounts.net
Subject:Unusual sign-in activity detected on your account
We detected a sign-in attempt to your Microsoft account from an unrecognised device in Romania.
If this wasn't you, secure your account immediately:
→ Review activity and secure account
If you don't act within 24 hours, your account may be suspended.
Red flags to teach
- Sender domain is microsoft-accounts.net — not microsoft.com
- Real Microsoft alerts link to microsoft.com — hover before clicking
- "24 hours or suspended" is classic urgency pressure
- Go directly to account.microsoft.com in a new tab — never click the email link
From:carlos.garcia@company-name.co
To:maria@company-name.com
Subject:Quick favour — urgent
Hi Maria,
I'm in meetings all day and can't take calls. I need you to process an urgent payment of €8,500 to a new supplier before 5pm. I'll explain the details when I'm out.
Can you do this? Reply and I'll send the account details.
Carlos
Red flags to teach
- Sender domain ends in .co not .com — one letter different
- Request to bypass normal payment process
- Deliberate unavailability ("in meetings, can't call") to prevent verification
- Policy: financial transfers always require verbal confirmation from a known number — no exceptions
From:no-reply@google-docs-sharing.com
Subject:Pedro shared a document with you: "Q3 Budget Review"
Pedro López has shared a Google Doc with you.
→ Open "Q3 Budget Review"
You'll need to sign in with your Google account to view it.
Red flags to teach
- Sender is google-docs-sharing.com — real Google shares come from google.com or drive.google.com
- Clicking leads to a fake Google login page that steals credentials
- If you click and it asks you to log in, close the tab and go to drive.google.com directly
- Confirm with Pedro via Slack/WhatsApp that he actually shared something
From:tracking@correos-delivery.com
Subject:Your parcel could not be delivered — action required
We attempted to deliver your parcel today but were unable to complete the delivery.
To reschedule, please pay a €1.95 redelivery fee within 48 hours:
→ Pay €1.95 and reschedule delivery
After 48 hours your parcel will be returned to the sender.
Red flags to teach
- Legitimate couriers rarely charge redelivery fees via email — and never this way
- The small amount (€1.95) is deliberate — it feels too trivial to question
- The real goal is your card details, not €1.95
- If you're expecting a parcel, go directly to the courier's official website and enter your tracking number there
How to run phishing training that actually works
Sending a one-off "phishing awareness" PDF once a year does almost nothing. The training that works is repeated, realistic, and gives immediate feedback.
Simulated phishing tests
Send fake phishing emails to your own team and track who clicks. Most endpoint security platforms and some email providers include this. The goal isn't to punish — it's to identify who needs more training and create a real teaching moment when someone clicks.
A written "what to do" policy
Staff need a clear, short procedure: "If you're unsure about an email, forward it to [person] before clicking anything." Without a process, people either click or do nothing — both can be wrong.
Quarterly briefings, not annual
Phishing tactics change. A briefing on current examples (like the ones in this article) every quarter keeps the threat real and the techniques current. 15 minutes per quarter is enough.
Celebrate reporting
If someone spots and reports a phishing email, acknowledge it positively. A culture where people feel safe reporting suspicious emails — even after they've clicked — is more valuable than one where they hide mistakes.
Training reduces risk but doesn't eliminate it. These tools catch what training misses:
- Browser-level phishing protection — Guardio blocks known phishing domains before the page even loads. It works at the browser level, so it catches links clicked from any source — email, Slack, SMS.
- Endpoint protection with web filtering — Bitdefender GravityZone includes web filtering that blocks malicious URLs even if an employee clicks through.
- MFA on all accounts — if credentials are stolen via phishing, MFA is the last line of defence. See our MFA rollout guide.
- Password manager — NordPass Business only autofills credentials on the legitimate domain. If an employee lands on a fake login page, the password manager won't autofill — a subtle but effective signal that something is wrong.
Guardio — browser security that blocks phishing before it loadsFrom $10/user/mo · Try free
The one rule that prevents most damage
Any request involving money or login credentials that arrives by email must be verified by a second channel — a phone call to a known number, a Slack message, a face-to-face conversation. This single rule stops invoice fraud, BEC attacks, and fake supplier requests cold. No exceptions, no matter how urgent the email claims to be.