Phishing Email Examples: 12 Simulations School Staff Clicked Most

Phishing Email Examples by Type

Over the past few months, schools have sent 244,473 phishing simulations through Tartan App. Staff clicked 9.9% of them.

Below we walk through 12 examples of the more effective phishing simulations from our library of over 1,000 scenarios. Each of these examples was generated using Tartan App's simulation generator with mock information.

All 12 have a click rate above 9.9% and four are more than double. Our training guide ranks the 60 simulations schools click most.

How to Tell If an Email Is Phishing

Tartan App's post-click training teaches six clues that expose real phishing emails.

From: Google Drive Notifications <[email protected]>

Subject: Document shared with you

1

23

1. 1The address behind the nameIt says Google Drive Notifications, but the address is schoolsecrityalert.com, not google.com.
2. 2Whether you expected itA salary review shared out of the blue is a reason to ask the sender first.
3. 3Where the link really goesHover over Open Document. The link doesn’t go to google.com.

• The sender's full address. A familiar name doesn't prove who sent it. Google says to “check that the email address and the sender name match.” A coworker's name on an outside address is a warning.
• Where the link goes. Hover over a link or button before you click. If the web address that appears isn't the app's real site, close the email. A QR code hides where it leads, so open the app or website yourself instead.
• A deadline or a warning. Emails that threaten your access, money, or account try to rush you. Most of the examples above set a deadline.
• A request for something sensitive. This might be a password, a Social Security number, an account number, or a payment. The FTC says to “contact the company using a phone number or website you know is real.” At school, open your bookmarked app, contact the help desk, or call the office.
• Whether you expected it. Stop if you didn't expect the file, invoice, alert, or request. Ask the sender another way, not by replying.
• Spelling mistakes. Typos still expose some fakes, but don't rely on them. CISA warns that with AI, “some emails will now have perfect grammar and spelling.”

What Staff See After a Click

When someone clicks a Tartan App simulation, the training page shows that exact email. It uses the heading “What gave this email away.” The page numbers two to four clues on the email. Staff review one clue at a time. The page ends with next steps. Don't click links, open attachments, or reply. Report the email instead.

Difficulty adjusts for each person. Everyone starts on the hardest level. After a click, that person's next simulation gets one level easier. Each unclicked simulation makes the next one harder.

What to Do If You Clicked a Phishing Link

• Tell your IT team right away, even if nothing seemed to happen.
• If you typed a password, change it on the real site. Change it on every account that uses the same password.
• Report the email, so IT can warn others and take it out of their inboxes.

Nobody should get in trouble for telling IT fast. Early reports limit the damage. In a Tartan App simulation, a click opens training that takes under 30 seconds. Our simulation guide covers how to run phishing simulations in a school.

How to Report a Phishing Email

• Gmail: open the message. Next to Reply, click More, then Report phishing.
• Outlook: use the built-in Report button.
• With Tartan App Shield: staff click one report button in Gmail or Outlook. The email goes to your IT team in Tartan App Threat Manager. IT can remove it from every inbox. Tartan App tells the reporter if the email was safe.

At Monroe School District, Tartan App moved 26 reported emails to spam in a median of 13 minutes. That time starts at the first staff report. See Tartan App's platform.

Phishing Email Examples FAQ