Scam email examples
This page collects real emails that were reported as phishing. Each one copies a known name, like a bank, a parcel service, a toll road or your own email provider, to get you to click, pay or share a password. For each example you can see what the email looks like, the subject lines and sender names used, the red flags, and what to do if it lands in your inbox. Private details are removed: addresses are masked, names are taken out, and links are shown as plain text that can't be clicked. We add new examples when a new wave is confirmed. If an email in your inbox looks like one of these, don't click anything. Delete it and check the real service on your own.
10 examples
Browse by brand
- German police
- Spotify
- Your email provider
- Atatürk University
- DHL
- Linkt
- Fake employer
- Puerto Rico FCU
- Santander Portugal
- Fake fund recovery
German police
Fake summons - answer within 72 hours
November 2026 · Germany, Austria, Switzerland
Spotify
Payment problem / update your payment details
November 2026 · Switzerland, Germany
Your email provider
"Your email password will expire in 24 hours" - keep current password
November 2026 · International
Atatürk University
Email access update required - log in to keep your mailbox
October 2026 · Turkey
DHL
Package held - pay a small processing fee to release it
October 2026 · International
Linkt
Unpaid toll / settle toll to avoid a penalty
October 2026 · Australia
Fake employer
"You are hired" - remote mystery shopper job
October 2026 · United States
Puerto Rico FCU
"Withdrawal requested" - log in to cancel it
October 2026 · Puerto Rico
Santander Portugal
"You have a new important message" - log in to read it
October 2026 · Portugal
Fake fund recovery
"We will recover your scammed funds" - recovery scam
October 2026 · International
These emails did not come from the companies or services they name. Brand names belong to their owners and are shown only to help you recognise the scam.
How we collect these examples
Each example is an email that was reported as phishing to the Mailbux security team. We publish it only after private details are removed: addresses are masked, names, tracking numbers and tokens are taken out, and links are shown as plain text that can't be clicked. We show the month an example was reported, not the exact date.
Last updated 10.11.2026 19:01 IL (10.11.2026 17:01 UTC)