You need to send an awareness email to your staff about phishing, and you don’t want to write it from scratch. Either that, or you simply don’t have the time for it.
You’ll find three ready-to-send templates below, plus examples for the most common threat scenarios. You can grab a template, drop in the details that match your situation, and send it within a few minutes. The bold bracketed text is the part you are supposed to change.
They’re written to actually get read: as short as possible and non-punitive. They’re focused on what makes staff pause before clicking, not on lecturing them about phishing.
Template 1: General Phishing Awareness Email to Employees
When to use: Use this to set a security standard across the whole team. For an introduction to phishing, an annual refresher, or any moment when everyone needs to be reminded what phishing looks like and how to respond.
Unlike targeted or specific alerts, general awareness emails like this one align everyone, regardless of technical skill, to the same defensive standard.
Subject: How to spot a phishing email, a quick guide for the team
Hi team,
Phishing is still the most common way attackers try to get into companies, and because of AI, the emails are getting harder to spot.
This is a short guide to help you recognize them and know exactly what to do, when you spot a suspicious or unsolicited email in your inbox.
What phishing looks like
Phishing is a message, usually an email, but sometimes an SMS, chat, or phone call, designed to trick you into sharing information, opening a file, or transferring money.
The sender pretends to be someone you trust: a colleague, a supplier, your bank, a delivery service, or a well-known company or government agency.
Three things to watch out for
Requests that feel off: a financial request from higher up, an unsolicited document being shared, somebody asking you to login to review something. There is a possibility these requests are not legitimate.
Pressure to act fast: “Reply within 24 hours.” “Before the end of day.” A senior colleague pushing you to transfer funds today for an ”acquisition we worked on silently.” If a message is pressuring you, that pressure itself is the warning sign.
Sender that looks almost right: You get an email from a colleague or one of our suppliers. The name in your inbox is familiar. But the actual email address, if you check it, has an extra letter or a domain that doesn’t make sense.
What to do if something looks suspicious:
- Don’t click links, open attachments, or reply.
- Don’t act on the request, even if it seems urgent.
- Report it: forward the message to [reporting/security team email] or use the Report Phishing button in [Outlook/Gmail/ETC].
When in doubt, ask. No one will ever be criticized for double-checking a message that looks off.
Thanks for helping to keep the team safe. Every reported message makes us harder to attack.
Sincerely, [Your name]
Template 2: Post-Incident Awareness Email
When to use: Use this after a real phishing attack has affected your organization.
Transparent and controlled communication like this email, sent to your workforce, helps transforming a real-world mistake into a moment you and your team can learn from.
It reinforces the conviction that leadership and workforce are serious about their defense, and are actively trying to improve it by talking about incidents, how they happened, and how to learn from them.
The [bold, braceketed text] gives the parts for you to fill in. The (sentences in parentheses) are guidance for the body of this email and should be deleted.
Subject: a phishing attack reached us this week, here’s what to watch out for
Hi team,
Earlier this week, a phishing email reached inboxes in our company. Here’s what happened, what the message looked like, and how you can keep your guard up going forward.
No email filter catches everything, and no training can make anyone immune to phishing. What protects us is thinking twice if we have the feeling something is off. Report it if you think it helps.
(Who were the attackers impersonating?)
[The attackers were impersonating a Bluehost employee][the CEO][a supplier][a government agency]
(How did the attack reach our employees?)
[The attack reached our employees by/through email][SMS][a phone call][a LinkedIn message]
(What were they trying to get staff to do?)
[They were trying to harvest credentials by sending our employees to a fake login page][They were trying to get our employees to transfer big sums of money][They were trying to get our employees to download a malicious file]
(What was the outcome as far as we know?)
[The phishing attempt was reported and blocked before anyone acted][One person clicked but no damage was done][It cost the company x amount, there was operational downtime, etc]
(What specific signs should employees watch out for?)
[Beware if the message is trying to isolate you, pressure you, or addresses you by your first name.][Watch out if the message has a shortened link, is supposedly from a higher-up, is asking you to perform a specific action, etc.]
If you happen to see something similar:
- Don’t click links, open attachments or reply.
- Don’t act on the request, even if it ”requires immediate attention.”
- Report it; forward the message to [reporting/security email] or use the report phishing button in Outlook
Thanks for your attention and consideration,
Sincerely, [your name]
Template 3: Monthly Awareness Reminder
When to use: This email keeps your phishing awareness present, preferably focused on a single warning sign that is relevant at this time. For example, that workers watch out for shortened links in emails, because those are prevalent at the moment.
A monthly reminder makes sure the phishing stays top-of-mind for employees, without triggering fatigue. A monthly reminder with one specific thing being covered, this email is valuable to send out to staff.
To be sure: you can input anything you want in place of the bold, bracketed texts. The text you see below are just examples.
Subject: Monthly phishing tip: [beware of authority signals][beware of shortened links][beware of isolation tactics]
Hi team,
For this month’s address we would like your attention for the following.
Be on your guard if you encounter emails with [authority signals][shortened links][isolation tactics].
What to watch out for
[Authority signals: messages that lean on the sender’s role, for example: you get a message from the CEO, a director, or high ranking member of IT or HR, to make you act without thinking.]
[Shortened links: URLs that hide the actual destination, like bit.ly or tinyurl links. It could also be a button.]
[Isolation tactics: messages that ask you to handle something quietly, because they’ve been working on a deal in secret and ask for your compliance and discretion.]
Attackers use this because [Authority bias triggers automatic compliance, people don’t tend to question decisions or requests made by seniors or other people in authority.]
[you can’t see the real destination before clicking, and because of that might send you to somewhere malicious to extract credentials or data.]
[cutting you off from colleagues or preventing you from double checking increases the likelihood you fall for the scam.]
A simple rule you can use going forward: [If a request from someone senior feels urgent or unusual, you can verify it in a different way. For example, you can call the senior member in question or double check with a colleague to be sure. Never act, especially if you’re not confident about the interaction.]
[Legitimate business emails almost never use shortened links. If you see one, you can hover over links and buttons to see the domain they lead to, and you can check if it’s the same as the sender’s domain. If they don’t match up, definitely don’t click.]
[Asking somebody to keep it a secret or preventing them from double checking with their team is a red flag. There is almost always an ulterior motive behind it. This request for secrecy is a warning sign.]
If you see something like this:
Report it: forward the message to [reporting/security email] or use the Report Phishing button in [Outlook].
Don’t click links, open attachments, or reply.
Don’t act on the request, even if it seems urgent. I appreciate your time and attention.
Sincerely, [your name]
How to Adapt These Templates To Your Team
Again, the bold and bracketed text is what that paragraph should roughly contain. These 3 templates are meant for the most common scenarios you would want to send these templates in.
The Emails You Send Regarding Phishing Should Feel Non-punitive
Nobody wants to feel accused, especially after a recent succesful phishing attempt targeted at your organization. The framing should always be that it is for the safety of the entire company and that mistakes happen.
Make It Timely and Specific
”Watch out for phishing” is a tad general and doesn’t add much value. If you are more specific and refer to time, your message hits better. For example, in the next month, watch out for messages with shortened links.
Use Good Tone and Readability
The templates work as they are, after you have added the relevant and right info. But the tone you bring and how readable they are after you complete them is what determines if employees want to read them and apply the principles inside.
What to Send Alongside the Email
In addition to the email(s) you send to your team, you could send your colleagues over to our phishing examples. We prepared an article that shows 6 real-life phishing email examples that target employees.
In it, we included the emails with special annotations so they know and recognize exactly what phishing emails targeted at them may look like.
Include The Security Department’s Email
Reporting phishing is a big part of internal security for businesses. Reporting ensures that personnel with the right authorization can potentially review phishing attempts that reach your colleagues, in Microsoft Defender.
At the end of each email, encourage them to either report it within Outlook or the proper email software you use, or that they forward the message to the actual email address of your security team. Example: security@bluehost.com.
Common Mistakes That Kill Awareness Emails
These are common mistakes that kill awareness emails:
- Sending too rarely: sending less frequent than once a month makes your staff forget
- Sending too often: Sending weekly or even more frequent may potentially trigger a ”whatever” response in your employees
- Including tips that are very obvious: ”Be careful with suspicious emails”
- Walls of text without proper structure: make sure to properly space out your text and use headings where applicable, for different sections
- Naming or shaming a person who fell for a phishing email
When Awareness Emails Aren’t Enough
Crafting and sending phishing awareness emails are a good start for your company if it isn’t already in place. Remaining top of mind and having a variety of phishing examples you can send to your colleagues can only help you improve your digital security.
They teach knowledge, but they don’t necessarily inspire or cultivate the confidence required when they are faced with actual phishing messages aimed at them.
The phishing emails that are the most effective are the ones that reach you on a friday afternoon at 4pm, and they read as a totally legitimate request. That is when phishing is it’s most dangerous and that’s what people fall for.
The Value of Phishing Simulations
Feel Free to Reach Out If You Have a Template Request
You can always send me a message at hello@ozarc.io. I will gladly take your request into consideration and add it to this article for reference, or send you the template personally.
Frequently Asked Questions
Monthly is a cadence that works well. Quarterly is considered too frequent, the phishing threat won’t stay top of mind for long enough. Weekly will only train your staff in ignoring emails.
No, the moment staff members feel criticized for making a mistake, you can rest assured that they won’t come forward the next time they perceive a potential threat. Reporting will increase if a blameless culture is created around phishing. High reporting rates are important for preventing attacks and succesful breaches.
No. Again, the same as above, it will prevent you building a blameless culture that encourages reporting and being forthcoming about digital threats. The correct move would be the send a post-incident email as in template 2, but without naming names.
A phishing test, also known as a phishing (awareness) simulation, is a fake phishing email sent out by the organization to see if anybody takes the bait. You can run them, but it can also undermine confidence your staff has in you.
The metric that matters the most is the reporting rate. What percentage of staff reports suspicious emails when they see or open them?
Repeated failures indicate that the training approach isn’t working for that person. Try one-on-one coaching, phishing awareness training/simulation, or pairing them with a colleague that reports well or knows how to respond to threats and how to spot them. That colleague can help the other colleague along and help them spot and avoid phishing.
Yes. The templates are applicable to all kinds of businesses. There are no limitations because of company size or industry. A lot of smaller businesses fare better with these kinds of tactics, since larger corporations may already depend on anti-phishing platforms, instead of internal communications like this, to strengthen digital security among staff members.
Leave a Reply