A simulated email that asks a colleague to re-authenticate their Microsoft 365 account is not useful simply because somebody clicks it. Its value comes from what happens next: whether the employee reports it, whether the security team can triage the report, and whether the result improves the organisation’s response to a real threat. The best phishing simulation examples test this full operational workflow rather than treating training as a click-rate exercise.
For UK organisations with large Microsoft 365 estates, simulation content should reflect the messages people actually receive: account notices, shared-document alerts, supplier requests and HR communications. It must also be proportionate. A campaign designed to measure reporting behaviour needs a different design from one intended to test susceptibility to business email compromise.
What makes a phishing simulation useful?
A credible simulation has a clear risk hypothesis. For example, a security team may want to establish whether finance staff verify changes to bank details, or whether colleagues recognise a fake Microsoft sign-in page. The template, audience, landing page and follow-up should all support that single objective.
Realism matters, but so does psychological safety. Simulations should create a reasonable decision point, not embarrass employees or exploit sensitive personal circumstances. Messages relating to redundancy, bereavement, medical results or payroll errors can create unnecessary distress and damage trust in the programme. In regulated or operationally sensitive environments, involve HR, legal and internal communications in campaign governance.
The strongest programmes measure more than clicks. Reporting rate, report speed, repeat interaction, credential-entry attempts and departmental patterns provide a more complete view of human risk. These results become far more useful when employee reports feed into phishing triage and investigation processes that mirror normal operations.
12 phishing simulation examples to use carefully
1. Microsoft 365 session expiry notice
This email states that the recipient’s Microsoft 365 session has expired and asks them to sign in again to retain access to Outlook or Teams. It tests recognition of common credential-harvesting tactics, particularly when the message is delivered during normal working hours and uses familiar service language.
Use a simulated sign-in page that records interaction without collecting real passwords. The learning point should focus on checking the sender, hovering over the destination where appropriate, and reporting the message through the organisation’s approved Outlook reporting mechanism.
2. Shared document notification
A message claims that a colleague has shared a confidential document through OneDrive or SharePoint. This works well because document-sharing notifications are routine in Microsoft 365 environments and recipients may act quickly to support a project.
The trade-off is that a generic document alert can become too easy to spot. Add a plausible document title and a recognisable internal context, but do not impersonate an individual in a way that creates personal friction. This scenario is particularly useful for teams that regularly exchange legal, financial or patient-related documents.
3. Multi-factor authentication prompt
The recipient is told that an MFA method needs updating or that a recent sign-in attempt requires review. The simulation tests whether employees distinguish a genuine security notification from a pretext designed to capture credentials or encourage MFA fatigue.
It should not ask users to approve a real push notification. Instead, use the scenario to reinforce that unexpected authentication requests should be denied and reported, while suspicious email should be assessed through trusted channels.
4. Supplier bank-detail change
A known supplier appears to advise that its bank details have changed, with an attachment or portal link containing the new information. This is a high-value business email compromise scenario for finance, procurement and accounts payable teams.
A simulation should test the verification process, not just email suspicion. Employees should be expected to confirm any payment-detail amendment using an independently sourced contact number and an approved workflow. If this control is weak, the issue is procedural as much as it is human risk.
5. Invoice overdue reminder
An overdue invoice email creates urgency by warning that services may be paused unless payment is made. It can test attachment handling, payment approval controls and whether staff challenge an unusual request from a familiar vendor.
Tailor this example to roles that genuinely process invoices. Sending it to every employee may produce misleading results, because most recipients have no business reason to interact with the message. Role-based simulations give security leaders evidence that maps to real exposure.
6. HR policy acknowledgement
The email asks employees to review and acknowledge an updated policy, perhaps relating to hybrid working, expenses or acceptable use. It tests a common social-engineering approach: exploiting routine administrative activity that recipients may expect to complete promptly.
Avoid sensitive themes. A neutral policy update can still provide a credible test while preserving confidence in both HR communications and the security awareness programme.
7. Missed Teams voicemail alert
This simulation mimics a notification that a new voicemail is available, typically with a button to play an audio message. Criminal campaigns often use this format to direct victims to credential-harvesting pages or malicious downloads.
It is valuable for measuring whether staff recognise that routine collaboration alerts can be impersonated. The training should explain how to access voicemail directly through Teams rather than following an unexpected email link.
8. Help desk password reset request
A message appears to come from IT support and claims that a password reset ticket has been raised. It may ask the recipient to cancel the request or confirm their identity. This tests trust in internal authority and is especially relevant where support functions are frequently contacted by email.
Coordinate the scenario with the service desk. Analysts and support staff need to know how simulated reports will be handled, and employees need a legitimate route to verify whether an IT notice is genuine. A simulation should improve operational confidence, not generate avoidable tickets.
9. External file-transfer notification
An email purports to come from a file-transfer service and advises that a large file is ready for download. This scenario is useful for organisations that exchange files with clients, suppliers, local authorities or professional advisers.
Test both link-based and attachment-based variants over time. The result can reveal whether employees are more likely to trust a recognised service name, an urgent file description, or the apparent identity of the sender.
10. Chief executive urgent request
An executive impersonation email asks a colleague to purchase gift cards, send contact details or handle a confidential task outside normal procedure. While gift-card fraud is well known, seniority and urgency still influence decisions, particularly in organisations with formal hierarchies.
Keep the request plausible and targeted. The appropriate outcome is not merely that staff avoid clicking, but that they use an established verification route before acting. This can expose gaps in escalation procedures for executive requests.
11. QR code sign-in lure
The message contains a QR code that supposedly allows fast access to a secure document, benefits portal or Microsoft 365 resource. QR phishing shifts the interaction from managed corporate devices to personal mobiles, where users may have less visibility of the destination URL.
This is increasingly relevant, but deployment needs care. Make sure the simulation can measure the scan or follow-on interaction appropriately, and provide specific coaching on treating unsolicited QR codes as links that require the same scrutiny.
12. Reported-message follow-up
This scenario is aimed at the reporting workflow itself. A simulated suspicious email is distributed, followed by a safe, controlled test of how quickly reports reach the designated mailbox or phishing-response platform, how they are triaged, and whether similar messages can be located and remediated across inboxes.
It is one of the most operationally valuable examples because it tests the defence beyond the employee. If a user reports quickly but the message remains in hundreds of mailboxes for hours, the organisation has identified a response gap that awareness training alone cannot solve.
How to run simulations without creating bad data
Start with a baseline campaign that reflects a routine threat, then use the outcome to select the next scenario. Repeatedly sending the same Microsoft sign-in lure may show improvement in recognition, but it can also teach employees to distrust every Microsoft notification. A varied programme is more realistic and reduces test familiarity.
Segment campaigns by job function, risk profile and business process. Finance teams need tests around payment fraud; administrators may need more focus on privileged-account prompts; frontline or shift workers may be more exposed to mobile-first lures. Comparisons between groups should account for the relevance of the scenario, not imply that one department is inherently less security-conscious.
Decide in advance what constitutes success. For many organisations, a prompt report is the preferred action, even if an employee initially opens a message. Measuring clicks alone can discourage reporting and obscure the positive behaviour that enables containment. Metrics should also distinguish between a report sent to the correct channel and one forwarded informally to a colleague.
Finally, connect simulation findings to protective controls. Recurring credential-entry attempts may justify targeted coaching, conditional access review or stronger Microsoft 365 protection. A rise in supplier-fraud interactions may call for clearer call-back procedures and payment-control reinforcement. Threat intelligence from genuine reported emails should shape future simulations, so the programme reflects the adversary activity facing the organisation rather than a static library of templates.
A well-run simulation gives employees a safe opportunity to make a difficult judgement and gives security teams evidence to improve the response around them. That is the useful standard: fewer unreported threats, faster phishing triage, and a workforce that knows how to turn suspicion into an actionable security signal.