# 13 Free Phishing Email Templates, Ready to Use Source: https://keepnetlabs.com/blog/phishing-simulation-templates Published: 2025-04-29 Updated: 2026-10-16 Author: Ozan Ucar, Founder and CEO of Keepnet Category: Phishing Simulation > Ready-to-use phishing email templates for AI-driven, QR code, voice and callback scams, with the red flags to watch for in each. **Phishing attacks** are evolving rapidly, with attackers now using AI technologies to create highly convincing scams. The human element appeared in **62% of breaches** in the [Verizon 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) (p. 12). Even with advanced email security systems and threat detection tools in place, attackers continue to exploit human behavior as the easiest entry point. Without regular practice, employees can still fall for increasingly sophisticated scams. Realistic practice emails let employees experience how deceptive these threats have become, helping them detect and report real attacks with greater confidence. In this blog, we’ll share **13 phishing email templates** you can use to strengthen your team's awareness, reduce risk, and protect your organization from modern phishing threats. ## Why Use Phishing Email Templates? Modern **phishing attacks** are highly convincing, using AI and deepfake technologies to mimic trusted sources across emails, messages, and even video calls. This makes it harder than ever for employees to distinguish real from fake. **Phishing email templates** offer a safe way to test and train employees by exposing them to realistic, evolving threats. Instead of relying on theory, teams build real instincts through hands-on experience. Regular practice with these templates helps organizations: - Identify users at risk. - Follow each click with a short lesson matched to the scenario. - Strengthen overall security culture. Today it’s critical to practice not just traditional phishing emails but also **AI-driven emails, QR code scams, callback attacks**, and **deepfake impersonations** to fully prepare your workforce. For more insights on how attackers manipulate emotions during phishing attacks, check out Phishing Examples by Emotional Triggers: How Scammers Exploit Human Emotions. ## 13 Phishing Email Templates to Strengthen Your Workforce **Phishing email templates** are most effective when they mirror the real tactics attackers use today. The more realistic and diverse your templates are, the better your employees can recognize and respond to threats. It’s no longer enough to practice only basic email phishing. Employees need exposure to a variety of attacks: **email scams, SMS phishing, QR code traps, callback phishing calls**, and even **deepfake impersonations**. Below, we highlight **13 essential phishing email templates** that can help you build a stronger, more resilient workforce. Each template targets different attack methods and emotional triggers, giving your teams the practical experience they need to spot and stop real-world threats. ### 1. Business Email Compromise (BEC) Template This template mimics an attacker posing as a high-level executive, such as a CEO or CFO, requesting an urgent wire transfer or sensitive financial information. The goal is to test whether employees verify unusual requests before taking action. Using a [Business Email Compromise (BEC)](https://keepnetlabs.com/blog/what-is-business-email-compromise-bec-how-to-prevent-it) **template** helps employees recognize red flags like urgent language, unusual payment instructions, and unexpected sender addresses, reinforcing a cautious mindset for real-world scenarios. ![Phishing Email Template on BEC/CEO Fraud: Lost My Wallet Template](https://timely-benefit-e63d540317.media.strapiapp.com/image3_b9be7e6f6e.png) *Picture 1: Phishing Email Template on BEC/CEO Fraud: Lost My Wallet Template* One example is the “**CEO Fraud: Lost my wallet**” template, where the attacker impersonates a traveling executive urgently asking for money to be wired. This type of emotional appeal leverages urgency and authority, two common triggers used in real BEC scams. #### BEC Attack Scenario Overview **Subject Line Example** Urgent Request - Need Your Help Today Email Body Template (Copy/Paste) Hi \[Employee Name], I’m currently traveling and need you to process an urgent wire transfer today. Please reply ASAP so I can send the payment details. This must be handled before end of business. Thanks, \[CEO Name] #### What Employees Should Notice - Unusual urgency - Executive authority pressure - Financial request outside normal workflow Use this template to see which employees verify unusual payment requests before acting on them. ### 2. QR Code Phishing (Quishing) Template This template tests whether employees scan unfamiliar QR codes that lead to fake login pages or malicious websites. Quishing attacks are especially effective in physical environments like office posters, flyers, or event handouts. An example from **Keepnet’s QR code templates** shows a spoofed "Google Account Recovery" email. It urges the recipient to scan a QR code to secure their account, exactly the kind of emotional trigger that attackers use to lower suspicion and prompt immediate action. ![Phishing Email Template on Quishing: Fake Google Recovery Alert with QR Code](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_on_Quishing_Fake_Google_Recovery_Alert_with_QR_Code_5c4b0ddd9f.png) *Picture 2: Phishing Email Template on Quishing: Fake Google Recovery Alert with QR Code* Use this template to train employees to think twice before scanning codes, especially those prompting logins, payments, or downloads. #### Subject Line Example **Security Alert: Scan QR Code to Secure Your Account** Email Body Template (Copy/Paste) Hi \[Employee Name], We detected unusual login activity on your Google account. To prevent suspension, please scan the QR code below and verify your identity immediately. Failure to act within 30 minutes may result in account lockout. \[**Insert QR Code Image**] **Security Team** #### What Employees Should Notice - QR code replacing normal login link - Fear + urgency trigger - Request to authenticate outside official portal Run dynamic QR phishing scenarios using the [Quishing Simulator](https://keepnetlabs.com/products/quishing-simulator). ### 3. Callback Phishing (TOAD) Template This template targets users with phishing emails that include a phone number, urging them to call for urgent support, often about suspicious account activity, subscription renewals, or malware alerts. Instead of clicking a link, users are tricked into calling attackers who impersonate IT or customer service agents. These **phone-based scams** rely on social engineering to extract passwords, gain remote access, or pressure employees into transferring funds. This template helps your team recognize **non-digital phishing attempts** and reinforces the importance of verifying all phone-based instructions before responding. #### Subject Line Example **Action Required: Call Support Immediately** Email Body Template (Copy/Paste) Dear User, Your Microsoft subscription has been flagged for suspicious activity. To prevent service disruption, call our support team immediately: 📞 1-800-XXX-XXXX Reference Case ID: MS-39482 **Support Desk** #### What Employees Should Notice - **Phone number instead of link** - **Pressure to call quickly** - **Fake “case ID” legitimacy trick** Train your employees against these rising threats using [Callback Phishing Simulation](https://keepnetlabs.com/products/callback-phishing). ### 4. Deepfake Voice Follow-Up Template This template mimics an AI-generated voicemail from a senior executive, followed by a short email asking the employee to “confirm” or “continue” an urgent request. Unlike traditional phishing emails, this scenario combines voice + email, exploiting trust in familiar voices and authority figures, one of the fastest-growing attack methods in 2026. #### Attack Scenario Overview Employees receive a voicemail that sounds like their CEO, CFO, or Director, created using AI voice cloning. Minutes later, a short follow-up email arrives referencing the voicemail and requesting quick confirmation or action. This multi-channel approach lowers suspicion and increases compliance. #### Voicemail Script (AI-Generated Voice Example) “Hi, this is \[CEO Name]. I’m in back-to-back meetings and can’t talk right now. I need you to quickly confirm the request I just sent by email. This is time-sensitive, please take care of it before the end of the hour.” \[**Ends abruptly**] #### Follow-Up Email Template (Copy / Paste) **Subject Line Example**: Following up on my voicemail - urgent Email Body Template: Hi \[Employee Name], Just left you a quick voicemail. Please proceed with the request as discussed and confirm once done. I’ll explain more later, timing is critical. Thanks, \[**CEO Name**] ### 5. Smishing Template Smishing, short for SMS phishing, uses text messages to lure employees into clicking malicious links or sharing sensitive information. These messages often appear to come from trusted services, urging users to reset passwords, verify accounts, or confirm payments. One example from **Keepnet’s SMS templates** includes a fake COVID-19 vaccine verification message, prompting users to click a suspicious link. This type of lure preys on urgency and public health concerns, making it dangerously convincing. ![Smishing Template: COVID-19 Vaccine Verification Scam](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_COVID_19_Vaccine_Verification_Scam_0234f7a413.png) *Picture 3: Smishing Template: COVID-19 Vaccine Verification Scam* This template trains employees to pause before acting on unexpected or urgent texts, especially those requesting credentials or personal data. #### SMS Message Scenario **Bank Alert: Suspicious charge detected**. Confirm your account immediately: http://secure-check-login.com #### What Employees Should Notice - Shortened suspicious link - Urgency trigger - Unexpected financial scare tactic Strengthen your mobile threat defenses with [Smishing Simulation](https://keepnetlabs.com/products/smishing-simulator). ### 6. Fake Meeting Invitation Template This template mimics calendar invites from platforms like Microsoft Teams, Zoom, or Google Meet. These emails often prompt employees to click a link and log in to view meeting details, redirecting them to fake pages that steal credentials. The example below from **Keepnet’s template library** features a spoofed Google Calendar notification where a “director” proposes a new meeting time. It appears routine but subtly lures the user into clicking a malicious link disguised as legitimate event info. ![Phishing Email Template on Fake Meeting: Google Calendar Invite with Fake Time Proposal](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_on_Fake_Meeting_Google_Calendar_Invite_with_Fake_Time_Proposal_525fbe657e.png) *Picture 4: Phishing Email Template on Fake Meeting: Google Calendar Invite with Fake Time Proposal* As calendar invites are a routine part of daily work, these attacks often bypass suspicion. This template teaches employees to verify meeting details and links before entering any login information. #### Subject Line Example **Updated Meeting Request - Action Needed** Email Body Template (Copy/Paste) Hi \[Employee Name], You’ve been invited to a new meeting: 📅 Quarterly Strategy Review ⏰ Tomorrow at 10:00 AM Please confirm attendance here: \[**View Meeting Details**] Regards, Google Calendar Team #### What Employees Should Notice - Routine calendar format reduces suspicion - Link leads to credential harvest - Unexpected invite from unknown organizer Learn how to better secure your digital calendar against calendar phishing. ### 7. Urgent Password Reset Template This template targets employees with emails impersonating popular services, pressuring them to reset their password immediately due to a supposed security issue. These messages rely on urgency and fear to prompt hasty action, making them one of the most effective phishing tactics. The **LinkedIn-themed scenario in Keepnet’s template library** presents a fake password reset notice, complete with a convincing link and a 24-hour expiration warning. It’s designed to make recipients feel vulnerable and rush to click without verifying the request. ![Phishing Email Template on Password: LinkedIn Password Reset Scam](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_on_Password_Linked_In_Password_Reset_Scam_3a1684f2bd.png) *Picture 5: Phishing Email Template on Password: LinkedIn Password Reset Scam* This template trains employees to slow down, scrutinize such alerts, and confirm their legitimacy through official channels before taking any action. #### Subject Line Example **Your Password Expires Today - Reset Now** Email Body Template (Copy/Paste) Dear \[Employee Name], Your LinkedIn password will expire in 24 hours. To avoid account suspension, reset it immediately using the secure link below: Reset Password Now Thank you, **LinkedIn Security Team** #### What Employees Should Notice - Fake deadline urgency - Brand impersonation - Link-driven credential theft ### 8. HR Policy Update Template This template targets employees with emails that appear to come from HR or payroll departments, asking them to review policy changes, complete surveys, or confirm benefits. Because these messages seem internal and routine, they're often trusted without question. A typical example in **Keepnet’s template library** is a fake healthcare benefits update email. It urges employees to complete a “required” questionnaire by a deadline, leveraging urgency, authority, and relevance to increase click-through rates. ![Phishing Email Template on HR Policy: HR Policy Update on Healthcare Benefits](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_on_HR_Policy_HR_Policy_Update_on_Healthcare_Benefits_96c8d42826.png) *Picture 6: Phishing Email Template on HR Policy: HR Policy Update on Healthcare Benefits* This template helps employees stay cautious when responding to internal requests and encourages them to verify such messages through official HR channels. #### Subject Line Example **Mandatory Benefits Update - Employee Action Required** Email Body Template (Copy/Paste) Hello \[Employee Name], HR has issued an important update regarding healthcare benefits for 2026. All employees must review and confirm changes by Friday. Access the policy document here: \[Review Benefits Update] **Human Resources** #### What Employees Should Notice - Authority + internal trust - Deadline pressure - Fake document link ### 9. Cloud Storage Access Request Template This template targets users with emails claiming their cloud storage accounts, like iCloud, Google Drive, or Dropbox, have been locked or compromised, prompting urgent action. These attacks play on fear of losing access to important data, pushing users to click without verifying legitimacy. This **Keepnet template** features a fake Apple alert stating that an iCloud ID has been locked due to multiple failed login attempts. It urges the recipient to verify their account within 24 hours, using urgency to lure them into clicking a malicious link. ![Phishing Email Template on iCloud: Fake Apple iCloud Login Lock Alert](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_on_i_Cloud_Fake_Apple_i_Cloud_Login_Lock_Alert_8abca85b73.png) *Picture 7: Phishing Email Template on iCloud: Fake Apple iCloud Login Lock Alert* This template helps employees develop a habit of independently validating cloud-related alerts and reporting suspicious account access claims through trusted support channels, not reactive clicks. #### Subject Line Example **iCloud Locked - Verify Within 24 Hours** Email Body Template (Copy/Paste) Dear Customer, Your Apple iCloud ID has been locked due to multiple failed login attempts. To restore access, verify your account immediately: **Unlock My Account** **Apple Support** #### What Employees Should Notice - Fear of losing access - Fake brand support - Link to phishing login page ### 10. Payment Request Template This template targets employees with emails requesting urgent payment updates, typically under the guise of failed transactions, overdue invoices, or suspended subscriptions. These attacks are crafted to trigger a quick reaction, especially from finance teams or subscription owners, without proper verification. This **Keepnet template** mimics a failed payment alert for a ChatGPT subscription, prompting the user to click “Update Payment” to avoid service interruption. The realistic design and brand familiarity make it easy to overlook red flags. ![Phishing Email Template: ChatGPT Subscription Payment Failure Alert](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_Chat_GPT_Subscription_Payment_Failure_Alert_eafeb4b296.png) *Picture 8: Phishing Email Template: ChatGPT Subscription Payment Failure Alert* #### Subject Line Example **Payment Failed - Update Billing Information** Email Body Template (Copy/Paste) Hi \[User Name], Your ChatGPT subscription payment was unsuccessful. To avoid service interruption, update your payment details now: Update Payment Method **Billing Team** #### What Employees Should Notice - Familiar SaaS brand lure - Finance-related urgency - Embedded payment phishing link This template sharpens employees’ awareness around payment-related emails and reinforces the habit of verifying all financial requests through secure portals, not embedded email links. ### 11. Prize Giveaway Template This template targets users with phishing emails that offer fake rewards, such as gift cards, contest entries, or prize money, to lure them into clicking malicious links or submitting personal data. These messages often appear during holiday seasons or promotional campaigns, making them seem timely and enticing. This **Keepnet template** features a spoofed cybersecurity-themed giveaway offering a chance to win from a $100,000 prize pool. The message uses bold visuals, festive language, and a call-to-action button to trigger excitement and impulse clicks. ![Phishing Email Template: Fake Prize Giveaway Email](https://timely-benefit-e63d540317.media.strapiapp.com/Phishing_Simulation_Template_Fake_Prize_Giveaway_Email_3a9337c29c.png) *Picture 9: Phishing Email Template: Fake Prize Giveaway Email* #### Subject Line Example **Congratulations - You’ve Been Selected**! Email Body Template (Copy/Paste) Dear Winner, To celebrate Cybersecurity Awareness Month, you’ve been entered into our $100,000 giveaway. Claim your prize now by confirming your details below: Claim Reward Good luck, **Rewards Team** #### What Employees Should Notice - Excitement + reward manipulation - Unexpected giveaway - Data-harvesting form trap This template helps employees spot red flags in unexpected promotional emails and avoid engaging with suspicious giveaways, even when they appear professionally designed. ### 12. Executive Video Call Wire Transfer Template (Deepfake) #### Attack Scenario Overview Scenario: Finance receives an urgent Teams invite. A video participant resembles the CFO and requests an emergency wire. Based on Gartner G00847786 patterns (executive impersonation on video, **35**% of orgs report video-call incidents in the 2026 CISO survey, n=297). #### Exercise Design - Target roles: AP clerk, finance manager, executive assistant. - Channel: deepfake voice or video exercise, or live coaching. - Success metric: employee refuses wire without second-channel verification. - Learning objective: no payment authorization from a single live call. ### 13. Fake Remote Hire Interview Template #### Attack Scenario Overview Scenario: HR schedules a final remote interview. The candidate uses a deepfake or coached proxy, matching G00847786 hiring/onboarding risk (North Korea infiltrator trend cited in the note). #### Exercise Design - Target roles: recruiters, hiring managers, IT provisioning. - Channel: process review plus an optional deepfake awareness briefing. - Success metric: anomaly flags (IP, device, identity mismatch) trigger in-person verification. - Learning objective: onboarding is part of the attack surface; HR and CISO share controls. Related: [deepfake statistics 2026](https://keepnetlabs.com/blog/deepfake-statistics-and-trends), [vishing simulations](https://keepnetlabs.com/products/vishing). ## Putting These Phishing Email Templates to Work Pick two or three templates that match what your teams see every week: invoice requests for finance, benefits updates for HR, and password resets for everyone. Adjust the sender name, branding, and timing so each email looks like it came from inside your organization, and send them in small batches instead of all at once. Keep the red flags from each template’s "What Employees Should Notice" section close at hand. When an employee clicks, show them those signs right away. When someone reports the email, thank them. Rotate in a new template every month so employees keep practicing instead of memorizing a single lure. When you are ready to send these templates across your workforce and see who clicks and who reports, you can run them through a [phishing simulator](https://keepnetlabs.com/products/phishing-simulator). ## Sources - Gartner G00847786: Cybersecurity Threat: Deepfake Identity Impersonation (Akif Khan, 28 May 2026). ## Templates Should Reflect Real Risk A phishing template is useful only if it reflects a workflow your users actually trust. Generic lures can produce clicks, but they often teach the wrong lesson. Better templates mirror the requests employees see in finance, HR, IT, legal, or executive communications. That also means template quality should be judged by what it helps you learn. A strong template gives you insight into reporting behavior, repeat-risk users, and which business contexts need more reinforcement. Keepnet teams usually see the biggest gains when training is tied to a reporting path and a follow-up workflow. For most organizations, the common mistake is treating phishing email templates as content delivery instead of behavior design. ### Template Checklist - Match each template to a real business workflow and a clear learning goal. - Use each template to measure reporting and decision quality, not only click rate. - Rotate difficulty so users face both simple and realistic lures over time. - Retire templates that no longer reflect current tools, branding, or attacker behavior. ### Related reading - [KnowBe4 alternatives (2026)](https://keepnetlabs.com/blog/keepnet-a-modern-multi-channel-knowbe4-alternative) - [Run phishing simulations step by step](https://keepnetlabs.com/blog/how-to-run-phishing-simulations-a-step-by-step-guide) ## Frequently Asked Questions ### Does Keepnet offer deepfake or executive impersonation templates? Yes. Template 12 (executive video wire) and Template 13 (fake remote hire) above follow Gartner G00847786 use cases. Use them alongside email templates to cover voice and video social engineering, not inbox-only programs. ### What Is a Phishing Email Template? A phishing email template is a pre-designed, customizable phishing email used to safely test employees against real-world phishing attacks. These templates mimic common scams, like fake password resets, CEO fraud, and fake QR codes, allowing security teams to measure susceptibility and improve user awareness without causing harm. To see how templates are used in a full exercise, read our guide on [what a phishing simulation is](https://keepnetlabs.com/blog/what-is-phishing-simulation). ### Where Can I Download a Free Phishing Email Template (Word or PDF)? You can find free phishing email templates in both Word and PDF formats from reputable cybersecurity vendors. These are often included in downloadable resource packs. Keepnet, for example, offers templates such as LinkedIn password scams and BEC scenarios for PDF export. ### How Do I Use an Editable Fake Email Template? An editable fake email template lets you customize sender names, branding, urgency cues, and payload links to mimic real phishing attempts. These are ideal for tailoring tests to internal environments, e.g., impersonating your own HR or IT department. Ensure your templates do not contain actual phishing malware, and always run them within a controlled, permissioned platform, such as Keepnet. ### What Is the Best Free Phishing Email Template for Employees? The best template depends on who you are testing. For financial teams, use a payment request template. For executives, use a CEO fraud template. If you're targeting mobile risk, the smishing (SMS phishing) template is ideal. Keepnet offers a range of free options, categorized by use case and emotional trigger, such as urgency, fear, and reward. ### How Do Free Phishing Email Templates Work? A free phishing email template gives you a ready-made message, such as a fake calendar invite or a password reset prompt, that you send to employees as a safe test. Their clicks, reports, or replies are tracked to assess risk, and employees who click can be given a short follow-up lesson. ### Can I Get Phishing Email Templates for Employees? Yes. Phishing email templates for employees are available in categories such as: - Internal HR update phishing - MFA fatigue attacks - Account security warnings - Callback scams with phone numbers Templates are typically editable and can be localized or adapted to specific departments. ### How Can I Generate a Phishing Email for Testing Purposes? To generate phishing emails safely, use a controlled platform such as Keepnet. You’ll be able to: - Select from pre-built templates (e.g., LinkedIn reset, COVID alerts) - Customize sender/subject/CTA - Send to targeted employee groups - Track click/report rates Keepnet’s “Generate Phishing Email” function supports templates across email, SMS, voice, and QR-based phishing vectors. ### What Makes a Great Phishing Email Template? A high-quality phishing email template: - Mimics real brands (e.g., Microsoft, LinkedIn, Apple) - Contains persuasive emotional triggers - Includes subtle anomalies (typos, fake domains) - Has a clear CTA (click a link, call a number) The goal is to closely mirror what users might face in real-world attacks without breaching trust or introducing real threats. ### What’s the Difference Between a Phishing Email Template and a Real Phishing Example? A phishing email template is a safe, ready-made message you send to your own employees as a safe test: sender, subject line, body, and a harmless link or attachment. A real phishing example is an attack that criminals actually sent. Good templates are built from real examples, so employees practice on the tactics they will actually face.