Phishing Email Templates
CanIPhish maintains an ever-evolving library of free phishing email templates that update with the latest trends. Take a look at our library and see the emails for yourself!
- 133 fake email templates
- 74 languages
- Updated with the latest trends
How phishing emails trick victims
Phishing emails typically have a common set of goals that can be used to identify what type of attack is taking place. These goals usually involve credential harvesting, endpoint compromise, or business email compromise (i.e., reply-to attacks). Armed with an understanding of what an attacker's goal is, you can identify the techniques an attacker will likely use to trick its victim into interacting with the phish.
-
Credential harvesting
For credential harvesting, an attacker will craft a phishing email that contains links or buttons that lead to a malicious website.
-
Endpoint compromise
For endpoint compromise, an attacker will craft a phishing email that contains a malicious attachment, enticing the victim into downloading and opening it.
-
Business email compromise
For business email compromise or reply-to attacks, an attacker will craft a phishing email that attempts to have the victim respond to them.
Ultimately, all phishing emails have a malicious goal and intention behind them.
Equipped with this information, take a look at our fake email templates and see if you can spot the goals behind them! Looking for a phishing email generator? Create a free account or try our email inbox simulator to see the unique ways we create phishing emails.
Fake Email Templates 133
Opens in a new tab
Skip past the templates-
AI Deepfake Alert Email
Subject: Your Deepfake AI Clone Preview Is Ready
Simulates an AI cloning company claiming it generated a deepfake preview using the employee’s public profile data, prompting them to enter their mobile number to receive an SMS viewing link.
-
Open AI Charge Email
Subject: OpenAI billing update: $18,150.01 charge processed
Email notifying the user that they have received a large bill from OpenAI.
-
AI Prompt Violation Email
Subject: Sensitive AI Prompt From Your Workstation
Simulates a compliance alert claiming sensitive company data was detected in an AI prompt submitted from the employee’s account.
-
Fireflies AI Important Meeting Email
Subject: Company update recording now available
Simulates an AI meeting assistant notification that prompts employees to access a company meeting recording and attached transcript using their work login.
-
Claude Business Account Email
Subject: Claude Pro access has been provisioned
Simulates a Claude Pro activation notice, prompting users to sign in within 48 hours to claim newly provisioned workspace access.
-
Shadow IT AI Account Activation Email
Subject: [Company] has assigned you a NeuralDesk account
A simulated onboarding email from a fictional AI SaaS vendor, NeuralDesk AI, framed as an internal IT rollout.
-
Google Store Free Device Email
Subject: Google Store Government Incentives
Email notifying the user that they are eligible for a marketing promotion.
-
Samsung Sign In Email
Subject: Suspicious sign-in to your Samsung account
Email notifying the user that a suspicious login has been detected.
-
Google Play Subscription Email
Subject: Your Google Play subscription to Roblox Premium
Email notifying the user that a Google Play subscription has been purchased.
-
Facebook New Login Email
Subject: Did you just log in near Gold Coast on a new device?
Email notifying the user that a new device has logged into their account and prompting them to take action to secure it.
-
Paid Discussion Scam Email
Subject: Paid discussion aligned to your experience
A paid advisory-style email that uses relevance, compensation, and urgency to lure recipients into engaging via a link.
-
Wise Sign Up Bonus Email
Subject: Pssst. We've Launched Our Best Deal Ever!
An email that appears to offer a too-good-to-be-true sign up bonus
-
Revolut Updated Terms And Conditions Email
Subject: We’ve updated our Terms — please review to keep your account running
An email claiming that terms and conditions have changed, causing your account to be suspended until the terms have been reviewed.
-
Airwallex Failed MFA Attempts Email
Subject: Multiple Failed MFA Attempts On Your Account
An email claiming that multiple MFA attempts have caused your account to be disabled.
-
Payoneer Account Verification Email
Subject: You Have Received A New Payment
An email claiming that a large payment has been received, but verification is required to release the funds.
-
Remitly Large Payment Sent Email
Subject: Your Payment Status
A vague email claiming that you've just sent a large payment which can be reversed
-
Remote Work Policy With Supervisor Email
Subject: Work From Home Update on behalf of [Manager]
Remote work policy update with a tempting link to view it
-
Shared File From Supervisor Email
Subject: [Company] file share on behalf of [Manager]
Supervisor file share with a tempting link to view the document
-
Supervisor Password Share Email
Subject: [Manager] sent you a file
Basic file share with a tempting link and message that uses the supervisor email field.
-
HR Expense Fraud Investigation Email
Subject: Expense Fraud Investigation
An urgent alert claiming suspicious activities in expense submissions, prompting immediate verification to avoid escalation into formal investigation.
-
HR Peer Feedback Received Email
Subject: Anonymous Peer Feedback Received
Notification of confidential feedback from an anonymous colleague, enticing employees to click through to see hidden comments.
-
HR Time Off Denied Email
Subject: ACTION REQUIRED: PTO Request Denied – Scheduling Conflict
An urgent warning that a PTO request was denied due to critical scheduling conflicts, requiring immediate attention to resolve.
-
CCTV Footage Review Email
Subject: Suspicious Activity Recorded at Your Desk Area
An unusual incident was recorded near the employee’s desk, and they’re asked to review the CCTV footage via a link or attached PowerPoint.
-
Voice To Text Fake Message Email
Subject: Message Preview: "Hey [First name], don’t stress, nothing bad. Just your name came up-"
Voice-to-text service that includes an enticing message.
-
Uber Eats QR Code Email
Subject: You’ve received a $100 Uber Eats voucher!
QR code style email that prompts user to scan the code.
-
IRCTC QR Code Email
Subject: Verify your number to process your refund
Fake refund request from the IRCTC
-
Adobe Acrobat Sign Email
Subject: Signature Required on "Mutual NDA [Company] & Nexora Group [Date]"
Email masquerading as Adobe Acrobat Sign prompting user to review and sign a document.
-
X Copyright Infringement Email
Subject: Content Infringement on @[Company]
Notification from X that the company’s page has a copyright infringement that requires review.
-
Microsoft Security Alert Email
Subject: Microsoft account security alert
Email advising that someone else might have accessed their Microsoft account.
-
British Airways Travel Voucher Email
Subject: £300 Voucher for Your Next British Airways Flight
Email from British Airways advising a voucher has been issued due to a previous flight change
-
Transport for London Lost Item Email
Subject: We found your bag!
Email from TfL advising that a bag has been found that contains cash and other belongings
-
Air New Zealand Password Reset Email
Subject: We've received your request to reset your password
Email from Air New Zealand for a password reset
-
BNZ Profile Update Email
Subject: Recent changes to your profile
Email from BNZ asking the user to review the changes to their account.
-
CEO Payment Authorization Form Email
Subject: Payment Review Needed Before EOD
This BEC phishing email is designed to impersonate the CEO and asks the user to process the payment by the end of the day.
-
Email Account Deactivation Email
Subject: Email Account Deactivation Notice
An unknown user management tool is requesting email verification to prevent the user from losing access to their account
-
Urgent Software Update Email
Subject: All Employees: Immediate Software Update Required
An email that pretends to be from the company’s IT help desk, advising the employee to perform an urgent software update.
-
Password Change Email
Subject: Please Change Your Password
Tech support advising a password change is required due to a recent security breach
-
Innapropriate Email Attachment Email
Subject: Immediate Review Required: Concern Regarding Recent Email Attachment
A message from HR asking the employee to review an email attachment
-
Microsoft 365 Quarantine Email
Subject: Microsoft 365 Security: You have messages in quarantine
Notification from Microsoft that an email is held in quarantine for review
-
Teams Task Assignment Email
Subject: You've been assigned a task
Notification from Microsoft Teams that a task has been assigned
-
Confluence Calendar Event Email
Subject: [Confluence] You've been added to an event in the "Events Calendar" calendar
Confluence calendar notification of an upcoming company event
-
ADP Direct Deposit Email
Subject: Direct Deposit Add or Change Notification
Alert from ADP advising of a direct deposit change
-
Monday Policy Violation Email
Subject: [New mention] Employee Policy Violation Register
Notification of inclusion in a policy violation register
-
Linkt Password Update Email
Subject: Cyber safety information regarding your Linkt account
Password reset required notification from Linkt
-
GoDaddy Security Breach Email
Subject: Alert: Your domain has been suspended.
GoDaddy notification requesting a domain be validated
-
-
-
Quickbooks Delete User Email
Subject: Confirm: You invited a user to QuickBooks
New user warning notification from QuickBooks
-
ZipRecruiter Job Offer Email
Subject: Exciting Opportunity to Join Our Team!
Fake job offer that originates from an automated job pairing system
-
Mailchimp Policy Violation Email
Subject: Urgent: Action Required for Compliance Violation
Mailchimp policy breach notification prompting user action
-
ClickUp Suspicious Login Email
Subject: Suspicious login to your ClickUp account
ClickUp suspicious login prompting a password reset
-
Shopify Unknown Bill Email
Subject: Your recent Shopify activity statement
Bill from Shopify enticing the recipient to view or dispute it
-
Apple Tax Invoice Email
Subject: Your tax invoice from Apple.
Apple invoice with a link to a fake login page
-
Vanta Outstanding Task Email
Subject: Your Organization Has Partnered With Vanta
Automated onboarding email notifying the user they have incomplete tasks
-
BambooHR Benefits Notification Email
Subject: Your Benefits Are In!
Automated email from Bamboo HR advising the user that their company benefits are active
-
Venmo Payment Notification Email
Subject: Payment Received Invoice #0887112
Notification advising the user that they have received a Venmo payment
-
Drata Account Inactivity Email
Subject: Action Required: Inactive Drata Account Notice
Inactivity notification prompting the user to login to their account
-
Request For Quote Email
Subject: Urgent Quote Needed: Yamabiko Corporation
-
Wire Transfer Confirmation Email
Subject: Confirm Receipt of Incoming Wire Transfer
Wire transfer notification prompting user to fill in an attached document
-
QR Code Enter to Win Email
Subject: Review Our Remote Working Policy & Win an iPhone 15!
Email asking employees to review a policy using a QR code as the method of interaction.
-
QR Code Office 365 Email
Subject: Your organization requires Multi-Factor Authentication
Microsoft 365 themed email utilizing a QR code attack.
-
QR Code Google Workspace Email
Subject: Your organization requires Multi-Factor Authentication
Email prompting an employee to use a QR code to verify themselves.
-
HR Device Violation Email
Subject: Urgent: Violation of Company Device Policy
Email from HR advising the employee has breached the device policy
-
Pento Password Expiry Email
Subject: Important: Password Expiry Notification
Password expiry email leading to Pento login phishing site
-
Jenkins Unauthorized Access Attempt Email
Subject: Unauthorized Access Attempt
Jenkins Security Breach Detected
-
Udemy Credits Email
Subject: [First name] you've received credits!
Udemy email sending users free credits
-
Bank of America Suspicious Activity Email
Subject: We've detected unusual activity on your account
Bank of America advising unusual activity with a link to login
-
Adobe Security Details Changed Email
Subject: Your Adobe security profile has changed
Adobe email alerting user security details have changed
-
-
Teams Message Email
Subject: Daniel sent you a message
Missed Teams message that leads to credential harvesting
-
Sharepoint Access Request Email
Subject: Sonny wants to access 'Company Profile Pictures'
Credential harvest attack using SharePoint request access function
-
Google Drive Shared File Email
Subject: Item shared with you: 'Updated Org Chart'
-
Zendesk Offline Chat Email
Subject: Offline Message from Sarah: Hi, I'm interested in using your service
Zendesk offline chat message
-
-
Trello Workspace Invitation Email
Subject: [Sender name] invited you to a Trello Workspace
-
Stripe Password Update Email
Subject: Your Stripe password has been updated
Stripe password updated.
-
LastPass Login Allowed Email
Subject: LastPass Security Notification: Login attempt allowed
LastPass allowed a recent login attempt.
-
Dashlane New Device Email
Subject: Here's the code you requested
Dashlane new device authentication code.
-
Bitwarden New Device Email
Subject: New Device Logged In From Safari
Bitwarden new device login notification.
-
1Password Password Change Email
Subject: The password for your 1Password account has been changed
Password change request for 1Password.
-
Conference Attendance Reply To Email
Subject: Conference Attendance Confirmation
Using a fake email chain to trick employees.
-
Business Opportunity Reply To Email
Subject: Unique Business Opportunity [URGENT]
Promises a lucrative business opportunity.
-
Lyft Company Rides Email
Subject: Employee benefits - 10 free rides until December 2025
Free company rides.
-
Xero Password Expiry Email
Subject: Your Xero password is expiring soon
Xero password is expiring soon.
-
Xero Profit Loss Statement Email
Subject: Here's your quarterly profit & loss statement from Xero
Quarterly company profit and loss statement
-
-
Google Meeting Invite Email
Subject: Invitation: Project Update @ [Date and time] ([Email address])
Google Meeting Invitation
-
STC Service Suspended Email
Subject: [First name], your account has been suspended
STC Account Suspension Notification
-
AMEX Card Confirmation Email
Subject: Confirm your recent card request
American Express new card request
-
-
Office365 Password Reset Email
Subject: [First name], here's your code
Password reset code for an Office365 account.
-
African Bank Unread Message Email
Subject: You have 1 unread message
African Bank Unread Message Notification.
-
GitHub OAuth App Email
Subject: [GitHub] A third-party OAuth application has been added to your account
An OAuth App has been added to your account
-
Spam Filter Quarantine Email
Subject: Quarantined Email End User Digest: 7 New Messages
Emails quarantined pending release
-
Deliveroo New Address Email
Subject: A new address was added to your account
New address registered on Deliveroo account
-
-
Qantas Unusual Login Email
Subject: Qantas Frequent Flyer - Unusual Login Activity
Qantas unusual login activity
-
-
-
Salesforce Reset Password Email
Subject: Salesforce password expiring in 3 days
Salesforce password expiration notification
-
Netflix Reset Password Email
Subject: Netflix password expiring in 3 days
Netflix password expiration notification
-
Instagram Verify Login Email
Subject: New login to Instagram from Chrome on Windows
Instagram unusual login activity
-
DocuSign Sign Document Email
Subject: Action Required: Expense Declaration for Fringe Benefit Tax Return
DocuSign expense declaration signature
-
-
-
Verizon Service Suspended Email
Subject: [First name], your account has been suspended
Verizon Account Suspension Notification
-
FedEx Shipment Tracking Email
Subject: FedEx Shipment 700333134573 Tendered to FedEx
FedEx Shipment Tracking Notification
-
Bell Canada Account Lock Email
Subject: Your account may have been accessed by someone else
Bell Canada Account Lockout Notification
-
CapitalOne Card Confirmation Email
Subject: Confirm your recent card request
CapitalOne Card Request Confirmation
-
AusPost Shipping Confirmation Email
Subject: We could not deliver your package
AusPost delivery failed
-
-
Ebay Item Purchase Email
Subject: [Receipt] Vizio M322i-B1 32-inch LED HDTV
Ebay item purchase via Paypal
-
COVID19 Work Survey Email
Subject: [Action] Complete your COVID19 Work Survey
COVID19 return to work survey attachment
-
-
AFP Subpoena Email
Subject: [Urgent] Subpoena Notice - Case: 312403
AFP Subpoena with attachment notification
-
HSBC Account Locked Email
Subject: Your account has been locked - Urgent
HSBC Account Locked Notification
-
Office Holiday Party Email
Subject: Office Holiday Party - Folder Share
Google Drive file share for office party
-
Women Equality Day Email
Subject: Google celebrates Women's Equality Day
Google is celebrating Women's Equality Day
-
BTC Account Deposit Email
Subject: Your purchase of $207.00 USD of BTC has been deposited in your account
BTC Purchase Receipt
-
Update Your Badge Email
Subject: ID Badge Update Needed - Urgent
Health employees need an updated ID badge
-
Booking Vacation Agreement Email
Subject: Organisation-wide Booking.com Partnership
HR sponsored vacation booking
-
Concur WFH Payment Email
Subject: How to Claim Your Work From Home Set-Up Payment
Concur payment for WFH setup
-
-
-
Govia Tax Invoice Email
Subject: Download your go via tax invoice statement now
Go via Tax Invoice Download.
-
CommBank Unread Message Email
Subject: You have 1 unread message
CommBank Unread Message Notification.
-
-
Linkedin Password Reset Email
Subject: [First name], here's your PIN
LinkedIn Password Reset Request.
-
Gmail Blocked Login Email
Subject: Security alert: Sign-in attempt blocked.
Gmail Login Attempt Blocked.
-
Facebook Verify Login Email
Subject: Verify your recent Facebook Login.
Facebook Login Verification.
-
-
OneDrive Word Share Email
Subject: [Sender name] shared "Employee Performance Reports" with you.
OneDrive Word File Share.
-
OneDrive Excel Share Email
Subject: [Sender name] shared "Quarterly Earnings Report" with you.
OneDrive Excel File Share.
No templates match your filters.
Curious about what you can do with our simulated phishing emails?
Phishing Email Features & Capabilities
-
1. Create, generate, or modify phishing email templates to suit your needs
Our simulated phishing platform is highly configurable, and using our HTML email editor, you can create, generate, duplicate, or modify existing phishing emails based on organizational requirements. In addition, the HTML editor gives you complete control over email content and design.
A common use case is that your organization may use bespoke software, interact with niche vendors, or have strict compliance requirements where you need to simulate specific content.
-
2. Choose from 74 different languages for each phishing email template
The CanIPhish team has invested significant resources in ensuring each phishing email in our library is multi-lingual in 74 different languages. This multi-lingual capability is coupled with our phishing websites and training modules, which are also available in 74 languages.
Multi-lingual phishing is particularly important for organizations with non-English speakers or a global employee base.
-
3. Dynamically insert personalized information to conduct spear-phishing
Inserting content at the time of email delivery is absolutely crucial to ensuring phishing emails are as realistic as possible. In support of this, the CanIPhish Cloud Platform allows for the dynamic insertion of content such as employee first names, last names, job titles, company names, and more.
-
4. Track and report against all forms of phishing email interactions
Delivering a phishing email is the first phase of running a successful phishing simulation exercise. The next phase is ensuring interactions are properly tracked and reported. This can include tracking who clicked on phishing links, who opened attachments, and who responded to phishing emails.
The CanIPhish Cloud Platform supports tracking and reporting against all three types of phishing interactions.
-
5. Benefit from emails themed after global and regional services
CanIPhish supports a variety of organizations across the globe, and while many organizations utilize global services, many also utilize localized services. These services include local banks, service providers, utility companies, etc. To ensure CanIPhish offers a diverse range of phishing templates, we selectively onboard and simulate these services at customer request.