Examples of phishing emails

A rogues' gallery of real phishing emails, sorted by the bank or organisation they pretended to come from. Bank Safe Online collected these from 2004 onwards. The wording has aged, but the tricks haven't: every one of them is still in use today, now also by text, WhatsApp and phone.

What to look for in every example

• A vague greeting. "Dear Valued Customer", "Dear Sir/Madam", or your email address instead of your name. Your bank knows who you are.
• A security scare. "Unusual log in attempt", "your account will be suspended", "new security system", "fraud level increased".
• A deadline. 24 or 48 hours, "immediately", "as soon as possible".
• A link to "log in", "verify", "update" or "reactivate". Banks never ask you to do this from an email.
• Odd details. American phone numbers in a "UK" bank's email, odd spelling, wrong currency symbols, "Dear Costumer".
• A request for something new. Your phone number, your card details, your memorable information, a one-time code.

What phishing looks like in 2026

The emails below asked you to log in on a fake website. Modern phishing does the same with a text ("a new payee has been added, if this wasn't you click here"), a WhatsApp message, a fake parcel fee, a fake tax refund or a phone call that follows the email. The goal has changed too: criminals now want your one-time passcode or your tap on approve in the banking app, not just your password. See phishing explained, fake fees, fines and refunds and passcodes and screen sharing.

Historic examples by bank

Jump to: Abbey / Santander · Alliance & Leicester · Bank of Scotland · Barclays · Clydesdale and Yorkshire Bank · Co-operative Bank / Smile · Egg · Halifax · HMRC · HSBC · Intelligent Finance · Lloyds TSB · Nationwide · NatWest · Royal Bank of Scotland · Visa / Mastercard · The Woolwich · Others · Malware emails

Abbey (now Santander)

Subjects seen: "Dear Abbey customer", "Unlock your e-banking account", "Important Message from Abbey National", "Urgent security notification", "Abbey Security Update".

This message is for Abbey United Kingdom customers only. Your Abbey Card balance is currently overdue and we require an immediate payment of J43.97. Go to your Abbey account, select the 'Set Up New Payment' option, and then follow the on-screen instructions. As soon as possible, please access your online account following the link below: [link removed]. If you've already spoken to us or you've put your account in order, please ignore this communication. Yvonne Smith, Abbey United Kingdom, Card payments Dept.

Giveaways: "J43.97" is a broken pound sign; a fake overdue payment to frighten you; the only action offered is a link.

Dear Valued Customer, our new security system will help you to avoid frequently fraud transactions and to keep your investments in safety. Due to technical update we recommend you to reactivate your account. Click on the link below to login and begin using your updated Abbey account. If you have questions about your online statement, please send us a Bank Mail or call us at 1-800-374-9700. Abbey Customer Care.

Giveaways: an American 1-800 number for a UK bank; broken English; "reactivate your account". The identical email was sent in the name of Intelligent Finance, which shows how criminals reuse one template across many banks.

Alliance & Leicester

Subjects seen: "Banking Alert", "Important banking email from Alliance & Leicester Internet Banking", "Alliance-Leicester Bank Anti-Fraud Team", "*IMPORTANT* Please Confirm Your Account".

Dear Mr/Mrs [name removed], we are committed to protecting you, with the latest technology to keep your details secure. 21 August 2006 our security system detected an unsuccessfull access attempt to your online account from Ip address [removed] that does not correspond to your current address [address removed]. Please click here to confirm your current address or change it online. If you do not confirm your address until 24 August 2006 your account will be SUSPENDED for security reasons. Yours sincerely, Adrian Grace, Security Department.

Giveaways: this one was personalised with the victim's real name and address, taken from an earlier data leak. Personal details in an email do not prove it's genuine. Note the three-day deadline and the threat of suspension.

Bank of Scotland

Subjects seen: "Bank of Scotland / Halifax phish", "Account Investigation Warning". Typical wording claimed an investigation was under way on your account and that you had to "confirm your identity" through a link to avoid your access being restricted.

Barclays

Subjects seen: "Barclays Bank Security Alert", "Be on your guard - beware of fraudsters", "Please update your account information", "Barclays IBank Reminder: PIease Update Your Data", "Fraudulent message from J. S. Smith - Security Advisor", "Security measures".

Dear [your email address], we recently noticed one or more attempts to log in to your Barclays IBank account from a different IP address. If you recently accessed your account while traveling, the unusual log in attempts may have been initiated by you. However, if you did not initiate the log ins, please visit Barclays IBank as soon as possible to check-up your account information: [link removed]. Thanks for your patience. Sincerely, Barclays Centre.

Dear customer, due to the dramatic increase in cases of online banking fraud, we took certain measures with the purpose of increasing the security level which will allow to keep your funds in perfect safety. For the new security system to be efficient, you have to give us your 'emergency' phone number, using which our managers can contact you if necessary. We will monitor all the clients' funds 24h a day, and in case of a slightest fraud suspicion our managers will call up the customers to clear the details and confirm or cancel a payment. To start the authorization procedure, please click this link.

Giveaways: addressed to your email address, not your name; "PIease" spelt with a capital I to dodge spam filters; and in the second email, a request for your phone number so that criminals can follow up with the "bank fraud team" phone call. Twenty years on, that combination of email then call is still the most dangerous scam there is.

Clydesdale Bank and Yorkshire Bank

Subjects seen: "Dear Clydesdale customer", "Download the new Clydesdale Bank online security", "Yorkshire Bank Phishing email". The "download our new security software" version installed malware rather than stealing a password: see malware emails.

Co-operative Bank and Smile

Subjects seen: "Co-operative Bank phish - fake survey", "Smile - please confirm your details", "Needed account information".

Valued Customer, you have been selected by the Cooperative bank online department to take part in our quick and easy 5 question survey. In return we will instantly credit 10 GPB to your account for your valued time. The information you provide us is all non-sensitive and anonymous. We kindly ask you to please spare 5 minutes of your time in taking part in this unique offer! Please visit [link removed]. Cooperative bank Customer Department.

Dear Customers! In connection with hard increase of fraud level for the first month of this year The Co-operative Bank p.l.c. takes operative actions on struggle with fraud and to increase the safety of our clients. For activation of changes we ask you to proceed under the link below and log on to your online account. In case of failure to meet requirements of bank within 48 hours, your account will be temporarily suspended in order to prevent unsafe transactions. Sincerely yours, The Co-operative Bank p.l.c. Security Department.

Giveaways: "10 GPB" instead of GBP; a reward for a "survey" that ends on a login page; a 48-hour deadline. Reward-for-survey emails are still common, now usually "pretending" to be from supermarkets and delivery firms.

Egg

Subjects seen: "Egg security upgrade alert", "Egg phish".

Hello - Your Secure login details seem to have been compromised. Please log in to the secure link below, and verify your security details to avoid an unecessary suspension of your account. We may call you to verify any information, and such calls may include computer-generated speach. To log in and verify your account click: [link removed].

Giveaways: no name, spelling mistakes, and a warning that you may get a "computer-generated" call, which prepares you to trust the follow-up.

Halifax

Subjects seen: "Dear Costumer", "Important regarding your account", "Confirm you Internet online banking", "Online confirmation procedure", "Important message from Halifax Bank", "Account Security Measures", "Security Alert". One Halifax phishing site had extra data entry fields asking for your full card number, expiry date, security code, date of birth and mother's maiden name, far more than a bank login ever needs. A page that asks for everything is a fake.

HM Revenue & Customs

HMRC phishing has run continuously since 2006. Then it was "you are eligible to receive a tax refund of £X, click here to submit your claim". Today it's the same by text, email and WhatsApp, plus fake "unpaid tax" and "arrest warrant" calls. HMRC never sends refund links, never asks for card details to pay a refund, and never threatens arrest. See fake fees, fines and refunds.

HSBC

Subjects seen: "HSBC Security Alert", "HSBC Online services team", "Notice! From HSBC Customer Support", "Dear Sir/ Madam", "Fraudulent message from J. S. Smith - Security Advisor". The "J. S. Smith - Security Advisor" email was sent in the name of several banks on the same day, with only the logo changed.

Intelligent Finance

From: www.if.com. Subject: Intelligent Finance Security Update. Dear Valued Customer, our new security system will help you to avoid frequently fraud transactions and to keep your investments in safety. Due to technical update we recommend you to reactivate your account. Click on the link below to login and begin using your updated Intelligent Finance account. If you have questions about your online statement, please send us a Bank Mail or call us at 1-800-374-9700. Intelligent Finance Customer Care.

Giveaways: word for word the same as the Abbey email, including the American phone number. The "From" address is a website name, not an email address. The sender field of an email can show anything the criminal types.

Lloyds TSB

Subjects seen: "Lloyds TSB Security Alert: Internet Banking Account Update", "Online banking security alert", "Update your account", "Dear LloydsTSB online customer!", "Lloyds TSB: please confirm your banking details". Lloyds TSB was one of the most imitated names of the period, with new versions appearing almost monthly.

Nationwide Building Society

Subjects seen: "Update your account record", "Verify your email adress", "Nationwide phish". The "verify your email address" version is a reminder that phishing doesn't always ask for a password at first: confirming your address tells the criminals the account is live and worth targeting again.

NatWest

Subjects seen: "Natwest Bank apply for Payment Protection", "NatWest Internet Banking", "Official Notice for all users of Natwest Bank".

Dear customer of the National Westminster Bank, NatWest would like to provide you its newest feature called 'Payment Protection Cover'. As an additional security measure, you need to activate this new feature by signing on to Internet Banking. Please verify your account information that NatWest uses to confirm your identity. Note: All NatWest Ibank customers are required to subscribe to Payment Protection Cover. However if you do not register for this new feature, we will have to temporarily limit or freeze your account until you have updated your NatWest Information. Yours sincerely, Craig Snyder, National Westminster Billing Dept.

Giveaways: a made-up product with a made-up obligation, a threat to freeze the account, and a "Billing Dept" that doesn't exist.

Royal Bank of Scotland

Subjects seen: "Our New Secure Software Upgrade For Royal Bank Of Scotland", "Royal Bank Of Scotland phish". "Software upgrade" emails led either to a fake login page or to a download that installed a banking trojan.

Visa and Mastercard

Subjects seen: "MasterCard Internet Online card record update", "Security Advisory", "Protect Your money with MasterCard profile", "Visa phish". Visa and Mastercard don't hold your account and never email cardholders to "update card records". The fake pages asked for the full card number, expiry date and security code, which is all a criminal needs to spend on your card.

The Woolwich

Subjects seen: "Woolwich Internet Banking: security maintenance", "Official Notice for all Woolwich customers".

Other organisations

Yorkshire Building Society, Clydesdale, Smile and many smaller institutions were targeted in the same way, usually with a template first seen against a bigger bank. Today the list includes every bank and building society, plus PayPal, Amazon, Netflix, Microsoft, Royal Mail, Evri, DVLA, the NHS and your own employer's IT department.

Malware and trojan emails

Not every scam email wants your password. Some want you to open an attachment or download a "security update" that installs a banking trojan: software that watches your screen and steals your login the next time you bank online. Examples from the Bank Safe Online archive:

Dell Online Store. Thank you for shopping with us. Your order # 35928 Panasonic RX-F18 8.0 MP Digital Camera has been accepted for the amount 697.00 Euros. Your card will be charged in that amount. You can check the order in your profile. Click here to see your order.

Subject: Bank Transfer Confirmation (ans-payroll.com). Attached: your payment confirmation.

Giveaways: an order or payment you know nothing about, in a currency you don't use, with a link or attachment to "check" it. The panic of a £600 charge makes people click. The same trick now arrives as fake "your subscription has renewed" emails and fake invoices with a "View document" button. The banking trojans of that era had names like Torpig, Haxdoor and Bancos; today's are Android apps installed from links, or remote access tools a caller talks you into installing. See malware and remote access scams.

Money mule emails

The other half of the archive is recruitment emails for "financial managers" and "UK representatives", which are how criminals launder what phishing steals. They're on a separate page: examples of money mule recruitment emails.

Last reviewed: October 2026