Featured Course
Phishing and Social Engineering Awareness Training
Complete Phishing and Social Engineering Awareness Training to recognize cyber threats, prevent attacks, and strengthen workplace cybersecurity awareness.
Phishing and social engineering examples include fake password-reset emails, fraudulent invoices, scam text messages, impersonated IT support calls, and malicious QR codes. Phishing is a type of social engineering that tricks people through deceptive messages. These attacks often exploit trust or urgency. Recognizing suspicious requests and verifying them independently can help employees avoid costly mistakes.
What Do Phishing and Social Engineering Look Like at Work?
Imagine receiving a message from your boss asking for an urgent payment. Their name looks right. The request sounds important. But someone else sent it.
That's social engineering: a scammer uses trust, fear, or pressure to get a person to do something unsafe. Phishing is one type of social engineering. It often uses fake emails, texts, or online messages to steal information or trigger a risky action.
Social engineering can also happen over the phone or in person. A caller might pretend to be your IT technician. Someone at a door might claim they forgot their employee badge.
The key difference: phishing uses deceptive messages, while social engineering covers a wider range of tricks.
9 Phishing and Social Engineering Examples in the Workplace
These nine situations are fictional examples, not reports of specific breaches. Each shows what an employee might encounter, what the scammer wants, and how to respond.
1. Fake Password-Reset Emails
You're checking your inbox when an email says: "Your work account will close in 24 hours. Reset your password now."
It has a familiar logo and a bright "Verify Account" button. But you didn't ask to reset anything. The button may lead to a fake sign-in page built to steal your password.
Warning sign: An unexpected login request paired with a deadline.
Safer move: Don't use the message's button. Open your usual company sign-in page yourself, or ask IT through its normal support channel. If you use Outlook, learn how to report phishing in Outlook using your organization's approved reporting option. The FTC's cybersecurity guidance also explains how phishing messages can put business accounts at risk.
2. Fraudulent Vendor Invoices
An accounts payable employee gets an invoice from a supplier the company uses every month. This time, the email asks for payment to a new bank account.
The invoice looks real.
Warning sign: A change in bank details that nobody has confirmed.
This can be business email compromise, or BEC. The scammer wants money sent to an account they control. The FBI recommends verifying account changes through a separate channel, such as a phone number already on file. Staff handling sensitive payments can also learn about security awareness in financial institutions.
3. CEO Impersonation and Urgent Payment Requests
Just before closing time, a message appears to come from the CEO: "I'm in a meeting. Send this payment now. Don't call me."
The message names a real project, so it feels believable. Yet it asks you to ignore the usual approval steps.
Warning sign: Someone uses their claimed authority to stop you from checking.
The FTC explains how business scammers use trusted identities and urgency to push people into paying or sharing information. Contact the executive through a number or channel you already know. A senior title never cancels your company's payment rules.
4. Fake IT Support Phone Calls
Your phone rings. The caller says they're from IT and need a one-time login code to fix a problem with your account.
They know your name and department. They sound helpful. That doesn't prove they work for your company.
This is vishing, or voice phishing. The fake support story is also an example of pretexting: making up a believable reason to gain trust.
Warning sign: An unexpected caller asks for a password, sign-in code, or account access.
Hang up and contact your real help desk using its approved number. Caller ID can be faked. Never give someone a code simply because they say they're fixing an issue.
5. Payroll Direct-Deposit Scams
A payroll worker receives a message that looks like it came from a coworker: "I've switched banks. Please update my direct deposit before Friday."
The name and job title match. But the real coworker never made the request. The scammer wants the next paycheck sent elsewhere.
Warning sign: An account change requested only through an unexpected message.
Use the company's normal identity checks before making any change. Ask the employee through an established channel or approved payroll system. Even a message from a real account could be sent by someone who broke into it.
6. Smishing and Fake Delivery Messages
A text says your package couldn't be delivered. It asks you to open a link, confirm your address, and pay a small fee.
You did order something recently. That's why the message gets your attention.
This is smishing, or phishing through text messages. The link may lead to a fake delivery page that collects payment details.
Warning sign: An unexpected text asking you to pay or share information through a link.
Check your order through the delivery company's official app or website. Don't assume the message is genuine because its timing seems right.
7. QR Code Phishing (Quishing)
A notice in the break room says, "Scan to verify your employee account." It includes a QR code and a familiar-looking logo.
Scanning opens a page asking for your work password. The code could have been placed there by a scammer.
This is quishing, or QR code phishing. A QR code is simply another way to open a link; it doesn't make the destination trustworthy.
Warning sign: An unexpected sign or message sends you to a login page you didn't seek out.
Check the web address, then use your company's official app or website instead.
8. Unexpected MFA Approval Requests
Your phone asks you to approve a work login. You aren't signing in. You reject it, but more requests keep appearing.
A scammer may know your password and hope you'll approve a request just to stop the alerts. This is often called an MFA fatigue attack.
Warning sign: Login approval requests you didn't start.
Reject them and tell IT immediately. Don't share one-time codes either. Multifactor authentication adds important protection, but some methods can be tricked. Phishing-resistant methods, such as properly configured security keys, offer stronger protection against many phishing attacks.
9. Fake Collaboration App Invitations
A message says your manager shared a private document for today's meeting. You open the link and are asked to let an unfamiliar app read your files or email.
The permission screen might belong to a real sign-in provider. The app requesting access, however, could be controlled by a scammer.
Warning sign: An unexpected document request that asks for broad account permissions.
The FBI's September 2026 consent-phishing warning explains how attackers can gain access through approved app permissions without learning your password. Verify the invitation independently. If you already approved the app, report it so your security team can remove its access. Changing your password alone may not fix this problem.
What Warning Signs Do These Attacks Have in Common?
The stories are different, but many use the same pressure points. A message might sound urgent, claim to come from someone important, or ask you to skip a normal check.
Watch for six patterns: urgent pressure, impersonation, password or code requests, payment changes, unfamiliar links, and requests to bypass procedures. None proves fraud on its own. Together with an unexpected request, they give you a reason to verify.
Don't judge an email only by spelling or design. Some scams are polished. Others come from real accounts that attackers have taken over. A padlock or HTTPS in a browser means the connection is encrypted; it does not prove that the website is honest.
Spotting these signs is one of the essential cybersecurity skills employees can practice. The goal isn't to distrust every message. It's to check unusual requests before acting.
What Should You Do When You Suspect an Attack?
Pause, verify independently, and report the concern. Your next step depends on what happened.
If you only received the message, avoid its links and attachments. Contact the person or company using a number, app, or website you already trust. Then report the message using your workplace process.
If you clicked a link, tell IT or your security team what you opened. A click does not always mean your account was stolen, but the team may need to check your device or browser.
If you entered a password, report it immediately and follow instructions to change that password and protect the account. If you approved an unfamiliar MFA request or app permission, say so clearly. Your team may need to end active sessions or revoke app access.
If you sent money, contact your finance team and the sending bank at once. The FBI's BEC guidance advises asking the bank for a recall or reversal and filing a report with IC3.
Don't hide a mistake because you're embarrassed.
Build Stronger Awareness With Phishing Training
Reading examples helps, but employees also need chances to practice spotting suspicious requests.
US Compliance Institute's Phishing and Social Engineering Awareness Training is a beginner-level, self-paced online course. Its published curriculum covers email and QR code scams, phone and text phishing, MFA abuse, manipulation tactics, and reporting habits.
The course fits general employees, managers, HR and payroll teams, finance staff, and remote workers.
Training also doesn't make an entire business compliant with every rule. Duties vary by industry and organization. NIST's cybersecurity learning guidance recommends ongoing programs that fit people's roles. Employers should connect awareness lessons with their broader data privacy and cybersecurity program.
Final Takeaway
Phishing and social engineering attacks often look like ordinary work: a bill to pay, a login to approve, or a message from a coworker.
The safest habit is simple. When a request is unexpected, especially if it involves money, passwords, or account access, check it through a trusted channel. Report suspicious activity quickly, even if you've already clicked or replied.
You don't have to solve the whole scam yourself. You just need to recognize when something deserves a second look.
