5 Common Types of Email Scams and Real-Life Examples

Understand and Stay Protected Against Email Scams

Email-borne cyber-attacks continue to plague businesses worldwide. Email scams continue to increase in 2026 by 13.8%, driven by AI in 44% of cases by creating more believable phishing emails. Organizations need email. Without it, communicating with people inside and outside the company would be more challenging. But since Ray Tomlinson introduced electronic mail (email) in 1971, malicious actors have exploited the medium.

What is an Email Scam?

An email scam is any nefarious activity that uses email to carry out an attack. Cybercriminals use email communications to commit fraud, steal money and data, and infect networks and devices with malware. An email scam is often multi-part, using email to penetrate a corporate perimeter while exploiting the recipient in some way.

Know the top 5 types of most common email scams, and learn how CyberSentriq can protect your inbox from them. Book a demo today.

What Happens When an Email Scam Succeeds?

Email scams are highly damaging when successful. One reason cybercriminals choose email for malicious activities is that it remains a popular way to communicate. At home or work, malicious emails and spam enter our inboxes daily. Emails are often part of a longer attack chain, including login credential theft and social engineering. If you were to engage with a scam email, then a variety of outcomes could occur, including:

Theft of Company Funds

BEC scams are the pinnacle of social engineering, often utilizing email scams during the attack. Business Email Compromise is human-centric, manipulating behavior to trick employees into moving company funds into a hacker’s bank account. Social engineering is at the heart of a BEC scam. BEC attackers use email impersonation or compromise to build trust with employees and supply chain vendors.

Credential Theft

Having a set of legitimate login credentials is like having the keys to a company’s bank vault. Cybercriminals use a variety of email scams to harvest credentials. The most common is phishing emails. These emails typically contain links to spoof websites that look just like a trusted brand’s login page. Enter login credentials into the page, and they will go straight to a cybercriminal who will use them to log in to the real app. Sometimes, a scam email will contain an attachment that contains a malicious link; this is an attempt to evade detection by anti-phishing tools. 

Data Theft

Email scams can result in data theft. A scam email may be used to steal administrator credentials that are then used to access sensitive areas of a network, allowing a cybercriminal to exfiltrate data. This often occurs by stealth and over many months, so it can be difficult to detect. Installation of ransomware via scam emails can also cause data theft. The loss of data results in non-compliance fines and lost customer confidence, which can also lead to further scam emails sent to customers who have had their personal data compromised. 

Malware (Including Ransomware) Infection

Ransomware (and other malware) infection is often propagated through email scams. Ransomware installation may be caused by the theft of login credentials, which leads to unauthorized access. Alternatively, a scam email may contain an infected attachment or link to a website that exploits software flaws on a device to load the malware. 
 

#1 QR Code Phishing (Quishing)

QR codes are popular because they are quick to create and use. The convenience of scanning and using a QR code has led to high market acceptance. The “State of QR Codes 2026” found that 71% of consumers believe QR codes are useful in daily life. Cybercriminals love popular technologies, and with 80% of consumers willing to share data via a QR code, QR code phishing has increased in parallel. 

QR codes contain instructions, like a link to a website. A smartphone camera or specialist scanner reads the QR code, and the user can then click the link. Cybercriminals use this process by embedding malicious links in QR codes.

QR codes, including tax and car parking machine scams, are now used in email scams. The UK's HMRC has been targeted by QR code-based email scams. Spoofed HMRC emails containing a malicious QR code were sent to customers. If someone scans it and follows the link, they are taken to a spoofed web page requesting bank details and other personal data.

#2 Business Email Compromise (BEC)

BEC scams are complex, often multi-part scams that use email. Emails are frequently spoofed to look like they come from a C-level executive. Email compromise is also used to hijack CEO or CFO email accounts. These scam emails are part of a cyberattack that builds trust with employees who oversee payments. BEC scammers will intercept company emails to find supplier details and look for invoices. The fraudsters then create new scam emails or modify legitimate ones to change an invoice's bank details to the fraudster's. The payment will then be sent to the hacker's bank account.

According to the latest FBI IC3 report, BEC email scam losses reached over $568 million, with $30 million lost to BEC scams involving AI.

A recent BEC-related tactic has worried Microsoft, with fraudsters circumventing a common authentication process. The fraudsters, part of a Russian hacking group, were able to gain access to senior executives’ accounts at Microsoft. This hijacking of a senior-level account is the basis for Business Email Compromise and many other potential cyber-attacks.

#3 Email Impersonation (Spoofing)

If fraudsters cannot easily hijack an email account, they use email spoofing or impersonation instead. Spoofed emails are designed to look like they come from a known individual, such as a CEO. Fraudsters create an email with the person's name and use wording that makes it sound like it is from that person. AI assistance can help in creating highly believable phishing emails. Email spoofing is an email scam that impersonates a high-level executive or other relevant employee and is often used in Business Email Compromise (BEC) attacks. Credential theft is also often associated with email spoofing attacks.

In 2022, the United States Department of Labor (DoL) was a victim of an email spoofing attack. The fraudsters spoofed the department’s domain, so the spoof emails looked like they came from the DoL site; an example is dol-gov[.]com. The spoofed email looked exactly like it was from the DoL. An attachment in the spoof email contained a PDF with a malicious URL. If the recipient clicked it, they were taken to a site designed to steal login credentials.

DMARC (Domain-based Message Authentication, Reporting and Conformance) enforcement helps detect and prevent email spoofing. The technology actively ensures the sender’s email address is trustworthy.

#4 Spear Phishing Emails

Cybercriminals often target specific employees, such as system administrators. If a scam email steals the login credentials of a targeted individual, such as an admin, fraudsters gain privileged access to sensitive network areas and apps. Spear phishing email scams are organized and often involve intelligence gathering on the part of the fraudsters. This allows spear-phishing emails to look highly realistic.
Spear phishing cyber attacks are becoming increasingly sophisticated, often using AI for reconnaissance and intelligence gathering, as well as to write phishing emails. A recent spate of “internal spear phishing” attacks used compromised internal mailboxes to build the victim's trust. The seemingly legitimate emails duped the recipients into actively engaging with the cybercriminal.

#5 M365 Targeted Phishing 

Trust is key to a successful email scam. M365's inherent trust makes a phishing attack more likely to succeed. This trust, combined with powerful Large Language Models (LLMs), creates hyper-personalized, scalable email scams. LLMs generate realistic, hyper-personalized email content to lure employees into clicking links or downloading infected attachments. AI agent-initiated OAuth consent attacks are making attacks faster and more personalized. QR codes are being automatically and rapidly generated to carry out quishing attacks.  Overall, AI is being increasingly used to scale the creation and delivery of email-based scams. Prompt injection attacks are even being used to manipulate LLMs into phishing users. 

Business Email Compromise and credential theft are two of the common outcomes of M365-targeted phishing attacks. Malware infection is another. Internal phishing often exploits M365's trustworthiness within an organization. The ‘Direct Send’ feature in M365 is being exploited to send authenticated messages to target users. The messages appear to be from company departments such as HR or accounting.

Other Common Email Scams and Spam to Watch For 

Cybercriminals are innovators. They will use any mechanism and any route into your email inbox to create an email scam. All of the email scams to watch out for below use social engineering to encourage the target to act in a way that benefits the attacker: 

• Delivery notice scams: Online sales have created a massive surge in online deliveries. Delivery notices are commonly used to inform customers of delivery schedules and issues. Cybercriminals piggyback on this common communication method by sending spoof delivery notices with links to phishing websites.
• Account suspension/password reset: Fear, uncertainty, and doubt are psychological drivers cybercriminals typically use in email phishing scams. Emails containing warnings about account suspensions or password resets with instructions to ‘click this link to resolve’ can cause a knee-jerk reaction in the user. The links will take the user to a spoof site that looks exactly like an M365 logon page or other productivity app login. If the user enters their login credentials, the attacker steals them and uses them to log in to the real application.
• Gift card request scams: Cybercriminals may pressure an individual into buying a gift card using ruses such as befriending them on social media or pretending to be their boss or a family member. Once the target buys the card, the attacker encourages them to take a photo or share the card’s code. The attacker can then spend the money on the card
• Callback (TOAD) phishing: To avoid email filters, attackers craft phishing emails without links or attachments and instead encourage the target to call a phone number. Emails will typically state that the recipient has paid a large amount to a subscription or similar. The cybercriminal hopes this will be enough to alarm the target into calling the number. The attacker behind the number will then use social engineering to manipulate the target into visiting a URL and downloading a malicious attachment.
• AI voice/deepfake follow-ups: Emails play a role in deepfake and AI voice attacks. These attacks are multi-channel, initiated via email; the attacker then socially engineers the target into taking an action, such as joining a conference call. The call uses deepfake technology to trick the victim into taking action, such as transferring money. AI voice and deepfake email-initiated Business Email Compromise (BEC) uses this process to steal large sums of money.

How to Spot an Email Scam: 8 Warning Signs 

Here are eight email scam warning signals that an MSP can share with its clients:

• Urgency: Cybercriminals exploit psychological drivers, such as fear and urgency, to override natural suspicion.
• Sender mismatch: Suspicions should be raised if the email sender domain differs from the expected domain. Email addresses, not the display name, should be checked. Also, links in the email should resolve to the expected domain.
• Lookalike domains:  Cybercriminals perfect lookalike domains to trick targets into thinking they are visiting the real website. They carefully manipulate the spoof website's URLs to trick users into thinking it is the real website. 
• Unexpected attachments: Always be suspicious of unexpected attachments. PDFs, Word documents, etc., can deliver malware, including spyware that steals sensitive data, such as login credentials.
• QR codes: Be cautious of emails that contain QR codes. The QR codes may be in an image in the body of the email or in an attachment to avoid email filters. 
• Payment details: BEC attacks may target employees in departments such as accounts payable by sending an email from a senior staff member with instructions to change payment details. Use caution and put processes in place to double-check these types of requests.
• Requests for gift cards: Be suspicious of gift card requests from unverified individuals.
• Unexpected charges: Emails containing unexpected charges that elicit concern should be dealt with caution.

How to Stop Email Scammers?

Email scams are complicated, often multi-faceted, and can be targeted. This complexity means stopping email scams isn't straightforward. To stop email scammers, you must use multiple layers of protection. The following are recommended for businesses wishing to create a secure environment for employees, customers, and the supply chain.

• Train your employees about email scams. When developing your security awareness campaigns, make sure you cover email scams. Use interactive, behavior-led training materials that tailor content to individuals. Check out CyberSentriq to see how to perform effective security awareness training.
• Use good password policies and MFA. Enforce robust passwords throughout your organization. Set up multi-factor authentication wherever supported. However, don’t rely on MFA, as there are circumstances where MFA is circumvented by fraudsters.
• Deploy advanced anti-phishing tools. Email scams are often designed to evade detection by conventional anti-phishing tools. Modern cyber threats need intelligent technologies to identify them as they emerge. AI-powered email security and anti-phishing technologies, like CyberSentriq’s AI-native email security, use multiple layers of increasingly granular and advanced protection to identify complex phishing and email scam threats. CyberSentriq uses Natural Language Processing (NLP) to identify email-based social engineering threats.
• Have payment checks and balances in place. Set up checks to ensure any emails requesting large money transfers or that seem suspicious are double-checked by another staff member. This helps prevent email scams that are used to carry out BEC attacks.

DMARC enforcement and DNS filtering 

Two essential security layers used to detect and prevent email scams involve DMARC enforcement and DNS filtering:

• DMARC enforcement: The DMARC authentication protocol determines what happens when an email fails to authenticate with the mail server. A DMARC policy tells the email server what to do with the failed email. Policy actions include quarantining or blocking the email.
• DNS filtering: A DNS filter prevents access to malicious, illegal, or inappropriate online content. Some DNS filters can prevent malware infection by stopping any access to malware-infected websites. Modern DNS filters are AI-powered to stop emerging threats.

How MSPs Protect Clients from Email Scams?

An MSP must take on the challenges of modern email scams on behalf of their clients. Complex, AI-assisted email scams can be prevented by using a layered approach. The essential layers needed to tackle modern email-based cyberthreats include the following: 

• Multi-tenant email security (MX + API): An MSP must be able to make changes to its client base easily from a simple, multi-tenant dashboard. Email security solutions for an MSP should offer an API for seamless integration into the MSP stack and a mail exchange spam filter (MX spam filter) to redirect email traffic to an email server set up to act as a spam filter. 
• Security awareness training with phishing simulation: Manipulating the human element is part of many email scams. Security awareness training that incorporates phishing simulations is an important layer in effective email security.
• DMARC rollout: An MSP's email security offering must include deployment and enforcement of DMARC policies.
• Per-client reporting: A multi-tenant email security solution should let an MSP generate per-client reports. 
• An incident playbook for when a client user clicks: If the worst happens and a user clicks a malicious link, an MSP should be able to use an incident playbook to mitigate the breach's impact.