Common Email Scams: 10 Examples and How to Spot Each One

The most common email scams are fake sign-in alerts, unpaid invoices, missed deliveries, gift card requests from a "boss," payroll changes, refunds and prizes, subscription renewals, shared documents, extortion threats and fake job offers. Almost all of them want the same thing: for you to click, sign in, pay or reply before you check.

They work at scale. The FBI's Internet Crime Complaint Center logged 1,008,597 complaints and $20.9 billion in reported losses in 2025. Business email compromise alone accounted for $3.05 billion of that, and phishing and spoofing produced 191,561 complaints (IC3 2025 report).

Below are ten scams you are most likely to meet, what each one says, the one detail that gives it away, and what to do instead. If you want to see real screenshots, our phishing email examples page shows twenty, with every red flag marked.

1. The account or sign-in alert

What it says: "Unusual sign-in activity detected." "Your mailbox is almost full." "Your password expires in 24 hours."

The tell: the button opens a sign-in page that isn't on the company's real domain. Check the address bar before you type anything.

What to do: close the email and open the app or website yourself. If there's really a problem, it will be waiting for you there. See a Microsoft example with the red flags marked.

2. The unpaid invoice

What it says: "Invoice #4471 is past due. Payment required today."

The tell: you don't recognize the vendor, the amount, or both, and the "invoice" is an attachment or a link to a document portal. The FTC lists "an invoice you don't recognize" as a classic phishing story (FTC).

What to do: check your accounting system, then call the vendor at a number you already have.

3. The gift card request from your "boss"

What it says: "Are you at your desk? I need a quick favor." A few messages later: buy gift cards for a client and send the numbers.

The tell: gift cards plus a request for the card numbers. In the FTC's words, "Only scammers will ask for gift card numbers and the PIN" (FTC, January 2026).

What to do: contact your manager through a number or address you know is real, not by replying.

4. The missed delivery

What it says: "Your package could not be delivered. Reschedule now." Sometimes there's a small redelivery fee.

The tell: you weren't expecting anything, and real carriers don't ask for card details to redeliver a parcel.

What to do: track the package on the carrier's own site with a tracking number from your order confirmation. Here's a FedEx example.

5. The payroll or bank-detail change

What it says: to HR or finance, from an "employee" or a supplier: "I've switched banks. Please update my direct deposit before Friday's payroll."

The tell: a money-moving request that arrives only by email, right before a deadline. This is business email compromise, the second most expensive category in the IC3 2025 report, behind investment fraud.

What to do: confirm every bank-detail change by phone or in person, using contact details already on file. No exceptions for urgency.

6. The refund, prize or government payment

What it says: "You're eligible for a refund." "You've won." "Claim your government payment."

The tell: you have to pay a fee, or hand over bank details, to receive money. The FTC lists "you're eligible to register for a government refund" as a scam outright (FTC).

What to do: delete it. Real refunds don't require you to pay first.

7. The subscription renewal (callback scam)

What it says: "Your annual protection plan renewed for $499.99. Call us within 24 hours to cancel."

The tell: there's often no link at all, just a phone number. The scam happens on the call, where someone "helps" you get a refund by installing remote-access software.

What to do: check your real accounts and card statement. Never call the number in the email. The same pattern shows up in fake voicemail messages.

8. The shared document

What it says: "A document has been shared with you." "Please review and sign."

The tell: you aren't expecting a document from this sender, and opening it asks you to sign in again.

What to do: ask the sender, through another channel, whether they sent it. See a DocuSign example.

9. The extortion threat

What it says: "I recorded you through your webcam. Pay $1,500 in Bitcoin within 48 hours or I send the video to your contacts." It may quote a password you used years ago.

The tell: the "proof" is an old password from a public data breach, not anything from your device. The IC3 received 89,129 extortion complaints in 2025 (IC3 2025 report).

What to do: don't reply and don't pay. Change that passphrase anywhere you still use it, turn on multi-factor authentication, and report it at ic3.gov.

10. The job offer that pays you first

What it says: "Remote assistant role, $45 an hour, no interview needed." Then a check arrives, with a request to deposit it and send part of the money on.

The tell: the FTC calls any offer to deposit a check and send money back "a sign of a fake check scam." The check bounces later, and you owe the bank (FTC).

What to do: never move money for an employer you haven't met. Report it at ReportFraud.ftc.gov.

Common email scams at a glance

Each line gives the scam, what it wants, and the fastest check.

• Account or sign-in alert: Your sign-in details · Open the app yourself
• Unpaid invoice: A payment · Call the vendor at a known number
• Gift card request: Gift card numbers · Ask your manager another way
• Missed delivery: Card details or a sign-in · Track it on the carrier's site
• Payroll or bank change: A redirected payment · Confirm by phone, using details on file
• Refund or prize: A fee or bank details · Real refunds don't cost money
• Subscription renewal: A phone call, then remote access · Check your real accounts
• Shared document: Your sign-in details · Ask the sender another way
• Extortion threat: Cryptocurrency · Don't pay; change that passphrase
• Fake job offer: Money sent back to them · Never move money for a stranger

Why these scams work on smart people

None of these scams go after carelessness. They go after busy, helpful people under a little time pressure. Every one of them uses at least one of six psychological tactics: urgency, scarcity, trust, helpfulness, authority or social proof. Once you know the six, a new scam looks familiar even when the story is new.

How to report an email scam

• At work: use your email app's report option (in Outlook, Report → Report phishing; in Gmail, More → Report phishing) or forward it the way your IT team asks. A fast report protects everyone else who got the same message.
• At home: forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and report the scam to the FTC at ReportFraud.ftc.gov, as the FTC recommends.
• If you lost money: call your bank first, then file at ic3.gov.

Frequently asked questions

What are the most common email scams?

Fake account and sign-in alerts, unpaid invoices, missed deliveries, gift card requests from a "boss," payroll or bank-detail changes, refunds and prizes, subscription renewals, shared documents, extortion threats and fake job offers.

What was the first widespread email scam?

The advance-fee scam, often called the "Nigerian prince" or 419 scam: a stranger promises a large sum in return for a small fee up front. It moved from letters and faxes to email in the 1990s, and the fake job and prize scams above are its modern versions.

How can I tell if an email is a scam?

Check three things: whether the sender's full address matches the name, where the link really goes, and whether you were expecting the message at all. Then ask what it wants you to do. If it's sign in, pay, buy gift cards or call a number, confirm through a channel you already trust.

Is there a list of scammer email addresses?

Not a useful one. Scammers rotate addresses and domains constantly, so any list goes stale within days. It's more reliable to check the domain after the @ and the request in the message.

What should I do if I already replied or paid?

Call your bank or card issuer right away, change the passphrase on any account you signed in to, and report it at ReportFraud.ftc.gov or ic3.gov. At work, tell your IT team immediately. Speed matters far more than blame.

Practice before the real one arrives

Reading a list builds recognition. Meeting the pattern in your own inbox builds the habit. Hook Security's phishing simulations send safe versions of these scams to your team, so the first time someone meets one it costs nothing, and the habit of pausing to check gets practice before it's needed.

Keep reading

• Phishing email examples with red flags
• How to spot a phishing email
• What to do if you click on a phishing link
• Email spoofing examples: 6 spoofed emails and how to spot them
• Spam vs. phishing: junk email examples and how to tell them apart