The most expensive phishing email in 2026 rarely looks like phishing. It looks like an invoice from a supplier you pay every month, a payroll notice from HR, or an MFA reset quoting a ticket number only IT would know. Business email compromise made up 15% of Australian businesses' cybercrime reports in FY2024-25 (ASD Annual Cyber Threat Report 2024-25), and the average self-reported cost to a small business hit $56,600. These twelve examples cover the lures actually costing Australian businesses money — and the tells that expose each one.
TL;DR
- Modern phishing is ordinary-looking: real logos, real names, plain text, no spelling errors. The tells are in the details, not the typos.
- The costliest Australian lures in 2026 are invoice fraud, payroll diversion, fake ATO notices and MFA-reset requests.
- Every lure creates urgency and uses an unusual channel — urgent payment today from the CEO by email is the pattern.
- Verify out-of-band: call the supplier on a number you already hold, never one from the email.
- Rehearse the real lures with monthly phishing simulations — recognition decays without practice.
Why modern phishing fools trained staff
Two decades ago phishing was a prince with a spelling problem. Today the lures are assembled from real data: your supplier's actual invoice format, your CEO's actual signature block, a lookalike domain one character off. Roughly 60% of breaches involve a human element (Verizon, 2025 DBIR) — and filters miss the plain-text, no-link versions entirely. Recognition has to be trained on the lures that actually arrive, which is what these examples are for.
The 12 phishing email examples
1. The supplier bank-detail change
An email from your regular stationery supplier: We've updated our banking details, please use the new account for invoice #4821 due Friday. Same logo, same signature, almost the same domain (one extra letter). The tell: a bank-detail change that arrives by email. The defence: call the supplier on the number from your last paid invoice — never the number in the email — before any payment change.
2. The payroll diversion request
Hi, I've changed banks — please update my direct deposit before this Friday's run. Thanks, Sarah. Sent from Sarah's real address because her mailbox was compromised. The tell: payroll changes by email, especially near payday. The defence: require staff to confirm bank-detail changes in person or by phone, every time, no exceptions.
3. The MFA reset
Your multi-factor authentication expires today. Reset now to keep access. Branded like Microsoft 365, linking to a credential-harvesting page. The tell: MFA doesn't expire — any expiry pressure on authentication is fake. The defence: report it, and never reach a login page from an email link.
4. The fake ATO refund
You're eligible for a tax refund of $412.50. Click to submit your bank details. The ATO's logo, a myGov lookalike. The tell: the ATO does not issue refunds by email link — check through your myGov directly. The defence: treat every tax message with a link as hostile and navigate to the service yourself.
5. The CEO gift-card request
Hi, I'm in a meeting — can you grab 5 x $200 gift cards for client thank-yous? Send the codes, I'll reimburse tomorrow. From the CEO's address (or one character off). The tell: urgent, small-denomination, untraceable — and executives don't buy gift cards by email. The defence: verify any payment request through a channel you already trust.
6. The shared-document notification
[Name] shared 'Q3 Payroll.xlsx' with you — a real-looking SharePoint or Google Docs notification leading to a credential-harvesting page. The tell: check the actual sender domain, not the display name; hover the button and look where it really goes. The defence: access shared documents through the app you already use, not the email link.
7. The voicemail delivery notice
You have a new voicemail — click to listen. Often targets phones, where the sender domain is hidden by the UI. The tell: your phone system delivers voicemail to your phone, not your inbox. The defence: report it.
8. The courier delivery failure
Your parcel couldn't be delivered — reschedule here. Sometimes with a small delivery fee that captures card details. The tell: you weren't expecting a parcel, or the tracking number doesn't match anything you ordered. The defence: go to the courier's site directly and enter the tracking number there.
9. The invoice with a changed amount
A real invoice from a real supplier — with the total changed and a note that pricing was updated. The tell: compare the amount and bank details against the purchase order before approval. The defence: a two-person rule on invoices above a set threshold.
10. The end-of-trial payment request
Your software trial has ended — pay to keep your files. Panic-inducing for a small team on a shared tool. The tell: check the vendor's site or your account directly; real vendors bill through the app. The defence: report it and check the account separately.
11. The recruitment lure
We reviewed your profile and want to interview you — confirm your details here. Data harvesting dressed as opportunity. The tell: you didn't apply; the application form asks for more than a CV. The defence: apply through the company's actual careers page.
12. The internal IT survey
IT is auditing access — confirm your username and password here. Internal authority plus a deadline. The tell: real IT never needs your password, for anything, ever. The defence: report it — this one should fail instantly for everyone.
The tells that cut across all twelve
Four patterns cover nearly every lure: urgency (deadline today, account closing, payment due now), authority (the CEO, the tax office, your bank), an unusual channel (payment changes by email, passwords by survey) and out-of-band verification that would break it (a phone call to a number you already hold). Train those four and the specific lures take care of themselves.
Turning examples into training
Reading about lures helps; rehearsing them helps more. Monthly phishing simulations using Australian-relevant templates — invoice fraud, ATO notices, payroll diversion — build the reflex these examples describe, and same-day coaching turns each miss into a lesson. Roll the results into human risk reporting so leadership sees the trend, and check the platform comparison before committing to a vendor.
FAQ
What are the most common phishing emails in Australia right now? Invoice and payment-redirection fraud, payroll diversion, fake ATO notices, MFA-reset requests and courier scams top the list — the lures that imitate routine business processes rather than dramatic ones.
How do I spot a phishing email? Look for urgency, an unusual request channel and sender details that are slightly off — then verify through a channel you already trust. If an email asks for money, credentials or a bank-detail change, it earns a phone call before any action.
What should staff do with a suspicious email? Report it — never reply, never click, never forward to colleagues. Report it even if they already clicked: fast reporting limits the damage far more than silence.
Are phishing simulations really effective against these lures? Yes — benchmark data shows click-prone share falling from 33.2% to 4.2% over twelve months of continuous training and testing (KnowBe4, 2026), when simulations use realistic local templates rather than generic ones.
How often should we refresh our phishing training examples? Monthly. Attackers rotate pretexts constantly; a template library that hasn't changed since last year is training staff for last year's attacks.
One last thing
The lures your business actually receives are the ones worth training on. Start with the examples above, watch what arrives in your own inbox over a month, and rehearse those — not the generic examples from a 2019 PowerPoint.