Email Phishing Examples: Spot the Fakes

Phishing emails can copy familiar branding, use your name and arrive in an existing conversation. Good spelling and a recognisable sender do not establish that a request is genuine. Pause before signing in, opening an attachment or changing where you send money.

Screen Australia impersonation warning

Warning published 3 September 2026. Sources checked 9 September 2026.

Screen Australia has warned about fake emails and promotional material claiming to come from the agency. It asks recipients to verify communications before replying, following links, opening attachments or sharing personal or financial information. Read Screen Australia's official warning.

1. Open a separate route. Type screenaustralia.gov.au into your browser, then use its Contact Us page to find an office number or the enquiry form. Do not use contact details supplied by the message you are checking.
2. Ask about the specific communication. Explain what it asks you to do and whether you have already acted. You can ask whether the agency sent it without opening an attachment to investigate further.

A familiar logo, sender name or checker result cannot establish that the agency authorised a message. Scam Checker is independent of Screen Australia. This section was drafted with AI assistance.

Quick Verdict

Red Flags to Look For

• Sender address doesn't match — "Netflix" but from netflix-billing@mail-service.example
• Generic greetings — "Dear Customer" instead of your actual name
• Urgency and threats — "Your account will be suspended in 24 hours"
• Unexpected attachments — Invoice.pdf.exe, Document.docm, or ZIP files
• Links to unexpected domains — On a computer, hovering can reveal a destination without opening it. A plausible-looking address is not proof of safety.
• Requests for sensitive info — Passwords, 2FA codes, card numbers
• Too good to be true — "You've won!" or "Unclaimed refund awaiting"

Illustrative Examples

These fictional examples show common warning signs; they are not verified reports of individual emails. The sample sender addresses use the reserved .example domain. Email text alone cannot establish whether an attachment contains malware or where an unseen link leads.

What to Do Next

1. Inspect the full sender address — Look for mismatches, but remember that a genuine email account can be compromised. A familiar name or existing thread is not enough.
2. Go direct — Open the service's app or type its known website yourself instead of following a suspicious email link.
3. Confirm payment changes independently — Call the supplier on a number from an earlier trusted record or independently found official website. Do not use the new number in the email, and do not rely on a reply in the same thread. Confirm the invoice and bank details before paying.
4. Leave unexpected attachments unopened — Verify the request first. A PDF label or familiar filename does not prove a file is safe; do not enable macros at an email sender's request.
5. Use a published reporting route — Use your email provider's phishing-report option or follow the organisation's official reporting instructions. Do not guess a phishing@company.com address. At work, follow your IT team's reporting process.

Scamwatch's business email compromise guidance explains why even a familiar business and message thread can be unsafe. The Australian Cyber Security Centre recommends verifying payment changes through a separate, trusted contact method.

If You Clicked a Link or Opened an Attachment

Frequently Asked Questions