Eight scams your team will meet this year. Practise them first.
Every lure is modelled on a real scam pattern and uses a made-up sender — never a real brand. Here's each one, and the red flags we teach.
deliveryObvious
Parcel redelivery fee
Parcel Delivery Service <redelivery@lure-domain>Action required: your parcel is on hold (£1.99 fee)We attempted to deliver your parcel today but an unpaid shipping fee is due. Your parcel will be returned within 24 hours unless the fee is paid.
RED FLAGS
!"Dear Customer": a real courier usually knows your name
!A tiny fee is a classic trick to collect card details
!A 24-hour deadline pushes you to act before you think
!The sender's domain isn't a courier you use
financeObvious
Tax refund
Tax Refund Office <refunds@lure-domain>You are eligible for a tax refund of £326.40After the annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund. Submit your claim within 3 working days.
RED FLAGS
!Government tax offices don't email you links to claim refunds
!Odd phrasing like "fiscal activity"
!Unexpected money plus a deadline
!Sender isn't an official government address
accountObvious
Mailbox full
Mail Administrator <mailadmin@lure-domain>Mailbox storage 98% full: messages will be rejectedYour mailbox has reached 98% of its storage limit. New messages will be rejected until you upgrade your storage.
RED FLAGS
!"Dear user" and a vague "Mail Administrator"
!Storage warnings appear inside your mail app, not by email from outside
!Threat that messages will be rejected
accountTricky
Password expiring
IT Service Desk <it-servicedesk@lure-domain>Your password expires todayThe password for your account expires today. To avoid losing access to email and files, keep your current password using the link below.
RED FLAGS
!"Keep current password" isn't a real IT process
!The link isn't your company's sign-in page
!IT came from an outside domain
!Threat of losing access creates panic
documentTricky
Shared document
Document Share <no-reply@lure-domain>A document has been shared with you: Q4 Budget.xlsxA colleague has shared a file with you. Q4 Budget.xlsx — shared via secure document link.
RED FLAGS
!It doesn't say which colleague shared it
!Real share alerts come from your own file storage
!Hover the button: the link isn't your file storage
!Budget files are tempting bait
financeTricky
Overdue invoice
Accounts Receivable <accounts@lure-domain>OVERDUE: Invoice INV-20931 – final reminderOur records show that invoice INV-20931 for £1,248.00 is now 14 days overdue. Arrange payment today to avoid a late payment charge.
RED FLAGS
!An invoice from a supplier you can't name
!Capital letters and "final reminder" to rush you
!Late charges as a threat
!Check invoices in your accounts system, not via email links
documentTricky
New voicemail
Voicemail <voicemail@lure-domain>New voicemail from +44 7700 900481 (0:42)You have a new voicemail message. Length: 0:42. Received: today. Play message.
RED FLAGS
!Does your company actually send voicemails by email?
!An unknown number creates curiosity
!The play link goes to a website, not an audio file
hrSubtle
Salary review
People Team <people-team@lure-domain>Confidential: your 2027 salary reviewFollowing this year's review, your updated salary and benefits letter is now available. Please read and acknowledge it by Friday.
RED FLAGS
!Curiosity about pay is powerful bait
!HR letters live in your HR system, not a link from an outside domain
!"Confidential" plus a deadline
!Your company name is easy for scammers to find
New lures added regularly. Using an attack we don't cover? Suggest one.
