Real Phishing Email Examples: What to Look For in 2026

Phishing emails are behind 38 per cent of all cyber incidents reported to the Australian Signals Directorate in FY2024-25. Despite better spam filters and more security awareness than ever, people still click. Phishing emails have become harder to spot, and the tactics used in Australian campaigns have become more targeted and more convincing. This post covers eight real Australian phishing email examples, the red flags in each, and what attackers are trying to achieve. Knowing what a phishing attempt looks like is one of the most effective things you can do to protect your organisation, alongside phishing awareness training for Australian teams that builds the reflex to act on what you know. Taking action and building secure habits is key to an effective cyber resilience program.

What Is a Phishing Email?

A phishing email is a fraudulent message designed to trick the recipient into handing over credentials, personal information, or money. Attackers impersonate trusted organisations such as banks, government agencies, parcel carriers, and cloud platforms to create a false sense of urgency or legitimacy.

Phishing emails range from mass-sent opportunistic campaigns to highly targeted attacks on specific individuals within an organisation. What unites them is intent: to deceive. The reader is manipulated into taking an action they would not take if they knew the truth.

8 Real Australian Phishing Email Examples

The following examples are based on campaigns actively reported to the ASD ACSC, Scamwatch, Services Australia, and ID Support NSW. Each includes the red flags that distinguish it from a legitimate message and what the attacker is actually after.

Example 1: ATO Tax Refund Phishing

Subject line: “Your tax return assessment is ready”

The email claims a tax refund is waiting and provides a link to log in to the ATO portal to claim it. Tax time (July to November) is peak season for ATO impersonation emails, and these campaigns are timed to coincide with when refunds are genuinely expected.

Red flags

• Sender address is something like ato-refunds@gov-au.com rather than @ato.gov.au
• Link goes to a lookalike domain such as myato-portal.com rather than ato.gov.au
• Email asks for bank account details to process the refund. The ATO never requests this by email.
• Generic greeting such as “Dear Taxpayer” rather than the recipient’s name

Attacker goal: Your myGov login credentials and bank account details.

What a real email looks like: The ATO sends notifications to your myGov inbox, not to your personal email. Refunds are processed automatically to the bank account already on file. The ATO does not email links asking you to log in.

Example 2: myGov Account Suspended

Subject line: “Action required: your myGov account has been suspended”

One of the most-reported phishing types in Australia. The email states that your myGov account has been suspended due to suspicious activity and must be reactivated within 24 hours. Urgency and a countdown are the core manipulation tactics.

Red flags

• Urgent language such as “your account will be permanently closed” or “act within 24 hours”
• Sender address does not end in @my.gov.au or @servicesaustralia.gov.au
• Reactivation button links to a domain with no connection to myGov
• Email requests your Tax File Number as part of the reactivation process

Attacker goal: myGov credentials, Medicare number, and personal identity information.

What a real email looks like: Services Australia sends notifications that direct users to log in via myGov.com.au directly. They do not include clickable login links in emails. Account issues are managed through the platform, not through external links.

Example 3: Commonwealth Bank Fraud Alert

Subject line: “Urgent: unusual activity detected on your account”

The email mimics a CommBank fraud alert, stating that a suspicious transaction has been flagged and the recipient must verify their identity immediately to prevent the account being locked. The sense of urgency is designed to short-circuit scepticism.

Red flags

• Sender domain is commonwealthbank-alerts.com or similar, not @commbank.com.au
• The “verify now” button leads to a convincing CommBank lookalike site
• Page requests card number, expiry, CVV, and internet banking password on a single form
• Footer uses a misaligned or slightly outdated CommBank logo

Attacker goal: Full online banking credentials and card details.

What a real email looks like: CommBank sends from @commbank.com.au. Fraud alerts direct you to call the number on the back of your card or log in via the CommBank app. For further guidance, see CommBank security guidance.

Example 4: Australia Post Delivery Held

Subject line: “Your parcel could not be delivered, action required”

A short, mobile-optimised email claiming that a delivery attempt failed and the recipient must pay a small fee or confirm an address to arrange redelivery. These campaigns spike during Christmas, click-and-collect peak periods, and major online sale events.

Red flags

• No tracking number or reference code anywhere in the email
• Redelivery or payment link goes to a third-party page, not auspost.com.au
• Email is vague about what was sent and by whom
• Hovering over the link reveals a domain with no connection to Australia Post

Attacker goal: Credit card details and your home delivery address.

What a real email looks like: Genuine Australia Post emails include your tracking number and link exclusively to auspost.com.au. Redelivery is arranged through the AusPost app or website at no charge. Australia Post does not request payment by email.

Example 5: NBN Disconnection Warning

Subject line: “Your NBN connection will be cancelled in 48 hours”

The email claims an NBN service is about to be disconnected due to an unpaid bill or account issue. The vagueness about which provider is involved is a tell. A real ISP will always reference your specific account, plan, and billing details.

Red flags

• Sender email is from a domain with no connection to your actual ISP
• ISP name may be absent entirely, referring only to “your NBN provider”
• Payment link redirects through multiple URLs before reaching a generic form
• No account number, plan name, or reference to the current connection details

Attacker goal: Credit card details, and sometimes the ISP login to take over the account.

What a real email looks like: Your NBN provider will always reference your account number, send from their own domain, and direct payment to their official portal. Disconnection threats come with written notice periods, not last-minute email warnings.

Example 6: ATO DocuSign Impersonation (2026)

Subject line: “ATO: please review and sign your document”

Reported in early 2026 and flagged by ID Support NSW, this campaign impersonates the ATO using a DocuSign-style template. The goal is to make the message look like an official document signing request, lending it an air of administrative legitimacy.

Red flags

• DocuSign is not a channel the ATO uses for individual taxpayer communications
• Signing link does not go to docusign.com but to a lookalike domain
• Completing the signing process prompts the user to enter their ATO Online Services login
• Document inside the template is a generic tax compliance notice with no specific account details

Attacker goal: ATO Online Services credentials, which also grant access to myGov.

What a real email looks like: The ATO does not use DocuSign for individual taxpayer communications. If you receive an email like this, do not interact with any links.

Example 7: ANZ One-Time Password Interception

Subject line: “Your ANZ secure verification code”

This is a more targeted attack. The victim is first led to a fake ANZ login page via an earlier phishing email. Once credentials are entered, the fake site requests a one-time password in real time, passing it through to the genuine ANZ site simultaneously. This is an adversary-in-the-middle attack that bypasses two-factor authentication.

Red flags

• Initial email or SMS links to a URL that is not anz.com.au
• OTP request page looks identical to ANZ but the URL is slightly different on close inspection
• A genuine ANZ OTP arrives on your phone while on the fake page, which indicates credentials have already been submitted elsewhere
• Page pressures you to enter the code quickly before it expires

Attacker goal: Full account access in real time, bypassing two-factor authentication.

What a real email looks like: ANZ will only ask for an OTP through the official ANZ app or on anz.com.au. They will never redirect you to an external site to enter a verification code.

Example 8: Microsoft 365 Storage Limit (Business Targeting)

Subject line: “Action required: your account storage limit has been reached”

Common in business environments, this email mimics a Microsoft 365 admin notification telling the recipient to sign in to manage storage or risk losing access to files and email. It targets individual staff rather than IT admins, making it harder to catch at a system level.

Red flags

• Sender is not @microsoft.com, typically something like no-reply@microsoft-365-alerts.com
• Sign-in page looks like Microsoft 365 but the URL is not login.microsoftonline.com
• Page captures username, password, and in some cases a one-time code
• Message lands in individual employee inboxes, not the IT admin console

Attacker goal: Microsoft 365 credentials, granting access to business email, SharePoint, Teams, and OneDrive.

What a real email looks like: Microsoft sends account and admin notifications from verified microsoft.com domains. Legitimate sign-in requests always go to login.microsoftonline.com.

Common Red Flags Across All Phishing Emails

Regardless of which organisation is being impersonated, most phishing emails share a set of characteristics. Training your team to recognise these patterns reduces the risk across every campaign type.

Sender address mismatch

The display name may say “ATO” or “CommBank”, but the actual email address tells a different story. Always check the full address, not just the name shown in the inbox.

Generic greetings

Phishing emails often address recipients as “Dear Customer” or “Dear Valued Member” rather than by name. Legitimate organisations that hold your details use them.

Urgency and artificial pressure

Countdown timers, threats of account closure, and “act now” language are deliberate techniques to prevent the recipient from pausing to think. Slow down before clicking.

Lookalike domains

Attackers register domains that look almost identical to the real thing. auspost-redelivery.com and myato.gov.au are not the same as auspost.com.au and ato.gov.au. Check the full URL, not just the first word.

Link destination mismatch

Hover over any link before clicking. If the URL that appears does not match the expected domain, do not click. On mobile, press and hold to preview the destination.

Unexpected attachments

Legitimate Australian government agencies and major banks do not send unsolicited attachments asking you to open them. An unexpected attachment from a known brand is a red flag.

Spotting a Phishing Email: Scan For S.C.A.M.

Phriendly Phishing’s S.C.A.M. framework gives employees a simple four-step check to apply to any incoming email or SMS.

S: Sender

Who is the Sender? Check the full email address, not just the display name shown in your inbox.

C: Content

Check the URL and look for spelling mistakes, poor grammar, or anything that does not look right.

A: Action

Scammers create a sense of urgency to push you into taking action using social engineering tactics. Pause before you click anything.

M: Manage

Manage the phishing email or SMS and report it to Scamwatch.

What to Do If You Receive a Suspicious Email

Do not click any links or download attachments. If you have already clicked, change the password for the affected account immediately and notify your IT or security team.

Report it. Forward suspected ATO impersonation emails to ReportCyber.gov.au. Report other phishing emails to Scamwatch. Both services use reports to identify and take down active campaigns.

Check the real source by logging in directly, typing the URL yourself rather than using the email link. If there is a genuine issue with your account, you will see it there.

Alert your team. If you receive a targeted phishing email at work, your security team needs to know. Others in the organisation may be receiving the same campaign, and a fast alert can prevent further damage.

How Phishing Simulation Training Reduces Your Risk

Reading about phishing examples builds awareness. Experiencing a simulated phishing attempt builds reflex. The difference matters when a convincing email lands in someone’s inbox at 4 pm on a Friday.

Phishing simulation training sends realistic, safe phishing emails to employees, tracks who clicks, and delivers an immediate learning moment at the point of failure. Over time, simulations reduce click rates and build the kind of instinctive scepticism that no amount of classroom training can replicate on its own.

To protect your team with Australia’s cyber security awareness training platform, or to see the platform in action, request a demo.