Phishing email
Fake emails impersonating brands to steal your login or card details.
How it works
An email looks like it's from Netflix, Microsoft, PayPal or your employer. It says your account is suspended or a payment failed, and links to a lookalike login page that captures your password and 2FA code.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
Microsoft 365 password expiry
Targets workplaces. An email says your password expires in 24 hours; the 'keep current password' button leads to a clone Microsoft login.
"Your Microsoft 365 password expires today. Click here to keep your current password: ms-keeppass-365.com"
Red flags to spot
- Does the sender address not match microsoft.com or your IT department?
- Are you being asked to click a button to 'keep' your current password?
- Does the URL preview not show login.microsoftonline.com?
- Is there urgency (expires today, account suspension imminent)?
PayPal 'unusual purchase'
An invoice for an expensive item lands in your inbox. The 'dispute this charge' link goes to a fake login that captures PayPal and 2FA.
"PayPal receipt: $1,289 to MacBook Reseller AU. If this wasn't you, dispute: paypal-disputes.help"
Red flags to spot
- Did you receive an invoice for a purchase you didn't make?
- Does the dispute link not point to paypal.com or the app?
- Are you being asked to log in through the email link rather than the app?
- Is the sender address a lookalike (e.g. paypal-disputes.help)?
Boss 'gift card' request
An email from a name that looks like your CEO asks you to quietly buy gift cards for a client. Sender address is a Gmail lookalike.
"I'm in a meeting — please grab 5 x $200 Apple gift cards for a client and send the codes. I'll reimburse later."
Red flags to spot
- Is the request for gift cards unusual for your workplace?
- Does the sender address use Gmail or a lookalike domain instead of your company domain?
- Are you being asked to send card codes by email or chat?
- Is the tone urgent and asking you to keep it quiet?
Red flags
- 🚩Sender address doesn't match the real company domain
- 🚩Generic greeting like 'Dear customer'
- 🚩Urgent action required within hours
- 🚩Hover preview shows a strange URL
What to do
- 1Never click links in account emails — go to the site directly.
- 2Turn on two-factor authentication on every important account.
- 3Report the email as phishing in Gmail / Outlook and delete it.
Who's targeted
- Anyone with an email address — work and personal alike.
- Users of widely-known brands: Microsoft, Netflix, PayPal, Apple, banks.
Why it works
- Brand templates are easily copied to look pixel-perfect.
- Urgent 'account suspended' language overrides careful checking.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1Microsoft 365 'unusual login' phishing.
- 2Netflix 'billing problem' lookalike.
- 3DocuSign / SharePoint shared-file phishing at work.
If you've already been scammed
- 1Change the password and enable 2FA on the affected account first.
- 2Check sign-in activity and revoke unknown sessions.
- 3Report the email as phishing in your mail client and to Scamwatch.
Frequently asked
How do I see the real sender?▾
Expand the 'from' line — display name can lie, the email domain can't.
Is it safe to reply asking 'is this real?'▾
No — you confirm your address is active. Verify by logging into the service directly.
What if I entered my password?▾
Change it immediately on the real site, log out other sessions, and turn on 2FA.
Questions people ask about this scam
- How does the phishing email work?
- An email looks like it's from Netflix, Microsoft, PayPal or your employer. It says your account is suspended or a payment failed, and links to a lookalike login page that captures your password and 2FA code.
- What are the warning signs of a phishing email?
- Watch for: Sender address doesn't match the real company domain; Generic greeting like 'Dear customer'; Urgent action required within hours; Hover preview shows a strange URL.
- How can I tell if this is a scam?
- Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
- What should I do if I clicked the link or replied?
- Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Never click links in account emails — go to the site directly. Turn on two-factor authentication on every important account. Report the email as phishing in Gmail / Outlook and delete it.
- What should I do if I already sent money?
- Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
- Where should Australians report this scam?
- Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.
General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.