Phishing Simulation Templates: 24 Examples Across Email, Teams, SMS, Voice and Deepfake

Good phishing simulation templates are hard to find. Each message has to fit the role and the level of the person who receives it, be new to them, and look like the attacks they get today.

Writing that by hand, employee by employee, is slow work for a security team. To help, Hoxhunt has put together these 24 phishing simulation ideas and examples: what to send on each channel, at four difficulty levels.

Every example shows the message as employees would receive it. Calls show what the caller says, and video calls show what happens on the call. Three notes follow: the lesson to send the employee after the simulation, the tells (the details that give the message away) and what employees should do when they spot those details.

If you are designing your whole simulation program, our guide to phishing simulation best practices is the place to start. If you are still choosing a phishing simulation platform, our guide to the best phishing simulation tools compares the leading platforms.

How difficulty levels work in these phishing simulation templates

Each template carries one of four levels (“Easy,” “Intermediate,” “Hard” or “Expert”), so you can match it to the person you send it to. Three things set the level: how many tells the message carries, how easy they are to spot and how closely its story (the situation the message claims to be about) fits the job of the person who receives it.

• Easy: a message with obvious tells, such as an unknown sender, a generic greeting or strong pressure to act now.
• Intermediate: a believable sender and an everyday request, with tells that need a second look.
• Hard: a message that fits the person’s work, with tells that are easy to miss.
• Expert: a targeted message with real-looking details about the person or the company, where the request itself is the main thing to question.

The tells in these examples, such as a look-alike domain or a tight deadline, show up in real attacks too. Our list of 14 phishing red flags explains how to spot many of them.

In most simulations, employees fail if they click the link or do what the message asks, and they succeed if they report it. In a phone call, they succeed if they hang up before they press a key or give the caller anything.

Why phishing simulations need different difficulty levels

A simulation that is too easy teaches little, and one that is too hard teaches people to give up. So the difficulty should rise for each person as they get better at spotting phishing. Done right, reporting keeps rising: across Hoxhunt customers, employees report 47% of their simulations when they start training and 67% after 12 months, even as the simulations keep getting harder (Hoxhunt Phishing Trends Report 2026).

Hoxhunt’s adaptive phishing training adjusts the difficulty for each person. When an employee keeps reporting simulations, the next ones get harder. When they keep clicking, the next ones get easier. Either way, employees get a micro-lesson the moment they report or click.

One simulation, two paths: what happens after a click and after a report.

How to use these phishing simulation templates

Each template is plain text you can copy. Text in braces, such as {first name}, marks a detail to fill in. Before you use one:

• Swap any made-up company, number or system for one your employees see every day.
• Keep the tells: they are what the lesson teaches.
• Choose the level that fits each person: “Easy” for people new to simulations, “Intermediate” as they get better at spotting phishing, and “Hard” and “Expert” as they keep improving. A card with a “Send to” line is written for the people it names, so send it only to them.
• Where a template names or impersonates a real person, such as a colleague, a manager or the CEO, use that person only with their consent.

With a phishing simulation platform:

• Create a custom template and paste in the subject and the message.
• Replace {first name} with the platform’s own placeholder for the employee’s first name, and fill in the other details in braces yourself.
• Use the platform’s tracked link in place of the link in the template.
• Show the lesson after the simulation, to the employees who click and to those who report.
• If the platform lets you mark the tells, mark them.

Without a platform:

• Use the templates as teaching material, for example in a team meeting or a security newsletter.
• Show a message, ask people to find the tells, then share what to do and the lesson.
• Don’t send the templates as real tests from an ordinary mailbox: without a platform, you have no reliable record of who clicked.

What “report” means: In every example, “report” means using the report button in the employee’s email client or chat app, which sends the message to the security team. For text messages, it means the reporting app the company uses. Where there is no button or app, and for calls and voicemails, it means telling the security team through the route the company uses for suspicious messages, such as a security inbox or the IT helpdesk.

Email phishing simulation examples, from easy to expert

Attackers keep coming back to everyday business lures. HR impersonation (8.2%) and invoice lures (8.3%) were two recurring themes in the AI-assisted phishing emails the Hoxhunt Phishing Trends Report 2026 analyzed. Calendar invites are risky too: in Hoxhunt’s simulations, employees fail them 24% of the time, about four times the usual failure rate.

Using these email templates: Load each one into your phishing simulation platform as a custom email template, following the steps above. Send calendar-invite templates as real calendar invitations, and attach the PDF to any template that has one, if your platform supports both.

In Hoxhunt, email simulations arrive as part of each employee’s adaptive training, and employees can report them with the Hoxhunt button in Outlook or Gmail.

Easy: a password expiry notice

EmailEasy

IT

IT Support[email protected]

Report this email

Your password expires in 2 hours

Dear {first name},

Your password will expire today. To keep your current password, confirm it within the next 2 hours:

Keep My Password

IT Support

Copy template

The lesson

Two hours to save your password? Cute, but that rush is the trap. Before you touch anything about your account, check who sent the email and hover over the link. Need a new password? Change it in your account settings, never through a link in an email.

The tell

The sender’s address ends in account-notices.example. That isn’t the company’s domain, so the email doesn’t come from the company’s IT team. The two-hour deadline is there to rush the employee past a careful look. And the “Keep My Password” link asks them to confirm their password from an email, when passwords are changed in the account settings.

What employees should do

Employees should check the sender’s address and hover over the “Keep My Password” link, without clicking, to see where it goes. They should report the email. To find out whether their password is about to expire, they can check their account settings.

Intermediate: an HR policy update to acknowledge

EmailIntermediate

PT

People Team[email protected]

Report this email

Action required: acknowledge the updated travel and expenses policy

Hi {first name},

The travel and expenses policy has been updated for 2027. Please sign in to the HR portal to read and acknowledge it.

Open HR portal

Thanks,
People Team

Copy template

The lesson

Look-alike alert! yourcompany-hr.example borrows your company’s name, but it isn’t your company. Hover before you click: if the link doesn’t go to your usual HR system, don’t sign in. If the policy update is real, it should be waiting for you in the HR system too.

The tell

The sender’s domain is yourcompany-hr.example: the company’s name with “-hr” added. Anyone can register a domain like that, so the email only looks internal. The “Open HR portal” link leads to a sign-in page outside the company’s HR system. That page is where the employee’s password would be stolen.

What employees should do

Employees should compare the sender’s domain with the company’s real one, and hover over the “Open HR portal” link to see whether it goes to the company’s HR system. To read the updated travel and expenses policy, they should open the HR system themselves or ask HR through a channel they already use. They should also report the email.

Hard: a calendar invite with a link

EmailHard

Send to: people who join budget or planning meetings

FO

Finance Operations[email protected]

Report this email

Invitation: Q4 budget review, Thu 10:00 to 10:30 AM

Hi {first name},

You’ve been invited to the Q4 budget review. The agenda and the figures to review beforehand are in the shared drive.

Open agenda

Accept · Tentative · Decline

Copy template

The lesson

Plot twist: meeting invites can phish too. A calendar feels safe, so it’s a great hiding place. Check who sent the invite and hover over the agenda link. An agenda that lives in your team’s shared drive should open there, so if the link goes anywhere else, find the agenda in the drive yourself.

The tell

The invite comes from yourcompany-team.example, a look-alike of the company’s domain, so the organizer isn’t a colleague. The email says the agenda is in the shared drive, yet the “Open agenda” link goes to an address outside it. A link like that usually leads to a fake sign-in page.

What employees should do

Employees should check the organizer’s address before accepting, and hover over the “Open agenda” link to see where it goes. They should look for the agenda in the shared drive or the team’s chat instead, and report the invite.

Expert: a supplier asking to change bank details

EmailExpert

Send to: people who pay supplier invoices

NS

Accounts Receivable, Northwind Supplies[email protected]

Report this email

RE: Invoice INV-20431, updated remittance details

Hi {first name},

Thanks for confirming the October order. Our bank has changed, so please use the attached remittance details for invoice INV-20431. If anything is unclear, call us directly at +1 202 555 0142.

Best regards,
Accounts Receivable, Northwind Supplies

Remittance_details_INV-20431.pdf

Copy template

The lesson

New bank details by email? Treat the request as an attack until the supplier proves otherwise. Attackers copy real orders and real suppliers, down to the invoice number. Call the number you already have on file, never the one in the email, before any money moves.

The tell

The email asks for an invoice to be paid into a new bank account, the core move of invoice fraud. It offers its own phone number for questions, so a call to check would reach the attacker. And it quotes a real-looking order and invoice number to make the request feel routine.

What employees should do

Employees shouldn’t open the attachment, pay into the new account or call +1 202 555 0142. They should call the supplier at the number already in the company’s records to check the change, report the email, and pay nothing until the change is verified.

Microsoft Teams phishing simulation examples

Microsoft Teams phishing simulations let employees practice spotting an attacker in the chat app they use with colleagues. There, a short request reads like everyday work. Teams marks messages from other organizations with an “External” label, and every example here carries it. What changes from one level to the next is how believable the sender and the request are.

Using these Teams templates: You need a simulation platform that can send messages inside Microsoft Teams. Ask your vendor whether it does. If you use a real colleague’s name, ask that person for consent first.

How does Hoxhunt do it? Teams simulations are part of Hoxhunt’s ready-made library, and employees can report them with the button built into Teams, just like a real attack.

Easy: a prize draw voucher

Intermediate: an IT service desk chat

Hard: a shared file from a colleague

Expert: a new contact at a supplier

SMS phishing (smishing) simulation examples

SMS phishing simulations, or smishing simulations, let employees practice spotting the attacks that reach them by text message. Text messages arrive on a phone, and that matters: in Hoxhunt’s data, employees fail phishing simulations far more often when they open them on a phone than on a desktop:

On a phone, employees are also 13 percentage points less likely to report a phish than on a desktop. And a text shows only a number or a short sender name, so the tells sit in that number and in what the text asks for: money, card details or a click on a link to an address the employee doesn’t know.

Using these text message templates: You need a simulation platform or service that can send text messages, and the employees’ mobile numbers. Ask your vendor whether it sends text message simulations and how employees report them. If a text names a real person, such as the CEO, ask that person for consent first.

At Hoxhunt, text message simulations are a managed service: Hoxhunt’s own team writes and sends the texts, within local telecom rules, and employees can report them in the Hoxhunt iOS app.

Our guide on how to prevent smishing explains how these scams work and how to stop them.

Easy: a package redelivery fee

Intermediate: the CEO’s new number

Hard: a declined corporate card payment

Expert: a payroll approval by text

Voice phishing and callback simulation examples

Voice phishing simulations let employees practice handling the attacks that move them onto a phone call, where there is no email address or link to inspect. There are two types. In a vishing simulation (vishing is voice phishing), the employee gets a phone call. In a callback simulation, an email asks the employee to call a number. Attackers use callbacks too: in the Hoxhunt Phishing Trends Report 2026, 5% of AI-assisted phishing emails carried a phone number meant to move the employee onto a call.

Using these voice templates: The callback example is an ordinary email template with a phone number in it, but to see who calls, the number has to connect to a service that tracks the calls. The call examples need a platform that places phone calls. Ask your vendor whether it supports either, and how it records the outcome. In a robocall template, pressing a key counts as a failure. In a callback template, calling the number does.

How does Hoxhunt run them? The caller in a Hoxhunt vishing simulation is a highly convincing AI voice, and the call goes to the number on the employee’s profile. Answering is not a failure: the employee fails only by giving information during the call. In callback simulations, the number connects to the same kind of AI voice agent.

Our guide to vishing attacks explains how these calls work.

Easy: a refund robocall

Intermediate: a callback about a subscription renewal

Email to phoneIntermediate

BT

Billing Team[email protected]

Report this email

Your annual subscription has been renewed: $399.00

Hi {first name},

Thank you for your payment. Your plan renews automatically today. If you did not authorize this charge, call our billing team at +1 202 555 0187 to cancel and get a refund.

Billing Team

Copy template

The lesson

No link to hover over? Then the trap is the phone number. Callback scams want you to dial, so a person on the line can talk you into paying or handing over access. Not sure about a charge? Check it in your account on the service’s real website, or ask finance.

The tell

The email comes from cloudsuite-renewals.example and shows a $399 renewal charge the employee doesn’t recognize. The point here is to worry them. Also, the only way it offers to cancel is a phone number, and calling it puts the employee on the line with the attacker.

What employees should do

Employees shouldn’t call +1 202 555 0187. They should check the charge in their account on the service’s own website, or with the finance team, and report the email.

Hard: a call from the IT helpdesk

Expert: a call from the company bank’s fraud team

QR code (quishing) simulation examples

QR code simulations let employees practice spotting a phishing link in a QR code. QR code phishing, also known as quishing, hides the link inside an image, so employees can’t see where it leads until they scan the code. QR codes fell to under 2% of attacks in the body of emails, but they have come back hidden inside attachments such as PDFs, according to the Hoxhunt Phishing Trends Report 2026. PDFs are also the most common malicious attachment, about a quarter of them.

Using these QR code templates: Make the QR code from the link your platform tracks, so a scan opens the lesson. Check whether your platform can create one code per employee, so you know who scanned. The site the code opens must never keep what people type. If you want to go deeper, our guide to QR code phishing walks through how these attacks work.

Easy: a free coffee voucher

Email with QR codeEasy

BC

Brew & Co Rewards[email protected]

Report this email

Your free coffee voucher: scan to claim

Hi there,

You’ve won a free coffee at Brew & Co this week. Scan the attached QR code with your phone to claim it before Friday.

Brew & Co Rewards team

coffee-voucher-qr.png

Copy template

The lesson

A QR code is a link you can’t read by looking at it. When a free coffee is only one scan away, stop and check who sent the email. A café you never signed up with doesn’t owe you a latte.

The tell

The sender, brewco-offers.example, claims to be a café the employee never signed up with. The greeting is generic, so the email went to many people. And the prize can only be claimed by scanning a QR code, which hides where the link goes.

What employees should do

Employees shouldn’t scan the code. They should check the sender’s address to see whether it’s a company they deal with, and report the email.

Intermediate: a QR code inside a PDF attachment

Email with PDFIntermediate

FM

Facilities[email protected]

Report this email

Updated parking permit form

Hi {first name},

Parking permits are being renewed for 2027. Please scan the QR code in the attached form to sign in and confirm your permit.

Thanks,
Facilities

Parking_permit_2027.pdf (contains a QR code)

Copy template

The lesson

Sneaky one: the QR code is hiding inside a PDF, where it’s easy to miss. A parking form that wants your password through a code deserves a check: ask Facilities directly. Your parking spot isn’t going anywhere.

The tell

The sender’s domain is yourcompany-office.example, a look-alike of the company’s, so the email isn’t from the Facilities team. The QR code inside the PDF leads to a sign-in page, and a parking permit has no reason to need the employee’s password.

What employees should do

Employees shouldn’t scan the code. They should compare the sender’s domain with the company’s, ask Facilities about the permit through a channel they already use, and report the email.

Hard: a multi-factor authentication re-enrollment

Email with QR codeHard

IS

IT Security[email protected]

Report this email

Action required: re-enroll your authenticator app

Hi {first name},

Our multi-factor authentication provider has released a new version of its app. Scan the attached QR code with your phone to re-enroll your device.

IT Security

mfa-re-enrollment-qr.png

Copy template

The lesson

Your sign-in is the key to everything, so attackers love asking you to “update” it. Real changes come from IT through channels you know. A QR code in an email can take you straight to a fake sign-in page on your phone. Ask IT before you scan.

The tell

The sender’s domain is yourcompany-secure.example, a look-alike of the company’s, so it isn’t the company’s IT. The email asks the employee to re-enroll their authenticator through a QR code that leads to a fake sign-in page, where the password and the sign-in code would be captured to take over the account.

What employees should do

Employees shouldn’t scan the code. They should ask IT through its usual channel whether re-enrollment is really needed, and report the email.

Expert: a contract to sign by phone

Email with QR codeExpert

Send to: people who sign supplier contracts

ES

e-Signature Service[email protected]

Report this email

Northwind Supplies has sent you a contract to sign

Hi {first name},

Northwind Supplies has sent you the 2027 supply agreement for signature. To review and sign on your phone, scan the attached QR code.

e-Signature Service

sign-on-your-phone-qr.png

Copy template

The lesson

Why a QR code? Because it moves you from your laptop to your phone, and people fall for phishing far more often on a phone. A familiar supplier and a believable agreement make the email feel safe. Ask your contact at the supplier before you scan.

The tell

The email asks the employee to scan a QR code with their phone to review and sign the contract, which moves them away from the computer where they would normally review a document, to a phone where the link’s address is harder to check. It also comes from esign-delivery.example, which isn’t the signing service the company uses.

What employees should do

Employees shouldn’t scan the code. They should ask their contact at Northwind Supplies about the contract, using the details already on file, and report the email.

Deepfake simulation examples: a cloned voice or face

Deepfake simulations let employees practice spotting an attack where AI copies the face or voice of someone they trust. The goal of the practice is a habit: employees should verify any urgent request through a channel they already know, however real the face or the voice seems.

Using these deepfake templates: You need a platform that can produce the cloned voice or video and run the call. Ask your vendor whether it does, and whose likeness it can use. Only use a real person’s face or voice with their consent.

How does Hoxhunt run them? In Hoxhunt’s deepfake simulations, the employee most often gets an email with an urgent request to join a video call, opens a page that looks like Teams, Zoom or Google Meet, and meets the deepfake there. Reporting the email still counts as a success even after joining the call, as long as the employee hasn’t clicked the link in the call’s chat. The ready-made deepfakes impersonate a role such as IT support or HR. Hoxhunt can also build a deepfake of your own executives, with their consent, so employees practice against the faces and voices they would actually trust.

Our guide to deepfake attacks explains how they are built and how to train against them.

Easy: a voicemail from IT support

Intermediate: an urgent call from IT support

Email to video callIntermediate

IT

IT Support[email protected]

Report this email

Urgent: join a quick call about a security issue on your laptop

Hi {first name},

We’ve found a security issue on your laptop that we need to fix with you today. Please join this short video call now so a support specialist can walk you through it.

Join video call

IT Support

Copy template

The lesson

Urgent call, look-alike sender: that’s how deepfake attacks often start. The person on the call can look and sound exactly like real support. Check the sender before you join, and contact IT through the helpdesk or the directory number.

The tell

The email comes from yourcompany-it.example, a look-alike of the company’s domain, so it isn’t the company’s IT. It pushes the employee to join a video call now, before they have time to check.

What employees should do

Employees should check the sender’s domain against the company’s real one. They shouldn’t join the call through the link. They should contact IT through its usual channel and report the email.

Hard: a video call from the IT director

Video callHard

Urgent: ransomware attack in progress

IT Director

Someone who looks and sounds like the IT director joins the call and says the company is being hit by ransomware right now. He asks the employee to install a protection tool from the link he has just posted in the call’s chat, before the attack spreads.

Copy template

The lesson

Ransomware is malware that locks a company’s files until a ransom is paid, which makes it the perfect panic button. Real fixes come through IT’s usual tools, whoever is on the screen. Leave the call and phone IT at the number you know.

The tell

The caller asks the employee to install a tool from a link in the call’s chat. Installing software from a chat link is a common way for malware to get in. The live emergency is there so the employee acts before checking who is really on the call.

What employees should do

Employees shouldn’t open the link in the chat. They should leave the call, phone IT at the number in the company directory and report the call.

Expert: an urgent payment request on a video call

Video callExpert

Send to: people who can approve payments

Urgent: confidential acquisition payment

Chief Financial Officer

Someone who looks and sounds like the chief financial officer (CFO) joins the call, apologizes for the short notice and posts a payment form in the call’s chat: a payment to a new account, to approve today and keep quiet until the deal is announced.

Copy template

The lesson

Seeing is no longer believing. When urgency, secrecy and a new account show up in one request, check it through a channel you already use, however senior the face on the screen.

The tell

The caller posing as the CFO asks for a payment to a new account, approved through a form in the call’s chat, today and in secret. Each part is a trap: the new account is where the money would go, the same-day deadline leaves no time to check, a form in the chat sits outside the usual approval process, and the secrecy stops anyone else from hearing about it.

What employees should do

Employees shouldn’t open the form in the chat. They should leave the call politely, check with the CFO through a number or chat they already use, and report the call. No payment should go out until the CFO confirms.

How to write phishing simulation templates that are realistic and responsible

A responsible phishing simulation template copies real attacks closely enough to teach employees what to look for, and it keeps their trust in the security team. That trust matters, because a simulation program only works if employees choose to report suspicious messages, and people who feel humiliated or picked on are less likely to keep reporting. These are the rules every template should follow:

Templates are one part of a simulation program. Our guide to phishing simulation best practices covers the rest: feedback after a click, recognition for the people who report, how fast the difficulty should rise, how often to send simulations and how to brief employees. Our guide on how to run a phishing simulation test walks through sending a single round, step by step.

Why manual phishing simulations don’t keep up, and how Hoxhunt automates them

As the examples show, one good simulation takes real work: a story that fits the person’s job, the right number of tells for their level, a lesson written for them, and a fresh version as soon as people learn to spot the old one. Now multiply that by every employee, six kinds of attack and every month. Reusing the same old templates doesn’t work either: once people learn to spot a template, it stops teaching them anything.

Hoxhunt’s adaptive training automates that work across email, Microsoft Teams, callback and phone-call simulations:

• Each employee gets simulations matched to their role, language and skill level.
• The difficulty rises after consistent success and eases after repeated failures.
• Employees get a micro-lesson the moment they report or click.
• Dashboards show how employees and the company handle simulations over time.

The Hoxhunt dashboard: badges, progress, a leaderboard and each employee’s skill profile by type of attack.

And that’s not all. Beyond email and Teams, Hoxhunt also runs text message and deepfake simulations. Its experts write and send the text message campaigns for you. The deepfakes range from ready-made ones that impersonate a role to custom deepfakes of your own executives, built with their consent. Simulations are drawn from a library that is constantly updated with real attacks, and two more tools go beyond it:

• Simulation Editor (in limited early access): a no-code editor in the Hoxhunt admin app for turning email templates like these into Hoxhunt simulations. You can duplicate an existing template, add placeholders that fill in details such as the employee’s first name, set up the link that counts as the fail and choose a difficulty from “Easy” to “Expert.” Our post on the Simulation Editor explains what it’s for: recreating the look and tone of the messages your employees actually receive.
• Spear Phishing Agent: an AI agent inside Hoxhunt’s adaptive phishing training that adds new simulations written from scratch for each person, just as a real spear phishing attack is written for one chosen target.

See how Hoxhunt’s adaptive phishing training picks and sends simulations for each employee, or book a demo.

Frequently asked questions about phishing simulation examples and templates

Sources

• Hoxhunt, Phishing Trends Report 2026: more than 50 million phishing simulations and millions of real malicious emails, sent to over 4 million users in 125 countries. Figures cited from pages 7, 9, 10, 17, 35 and 39 to 41.