Subject lines are critical to phishing simulation success. They must be realistic enough to catch users while being educational rather than malicious. This guide provides tested, effective subject lines organized by template category and difficulty level.
⚠️ URGENT: Package Delivery Failed - Immediate Action Required!!!
🚨 YOUR PACKAGE IS BEING RETURNED - CLICK NOW!
DELIVERY ATTEMPT #3 - LAST CHANCE!!!
Package delivery issue - respond within 24 hours or package will be returned
DHL: Package delivery attempt unsuccessful
FedEx: Your package requires address verification
UPS: Delivery exception for tracking #1Z999AA1234567890
Package pickup available - verify delivery address
USPS: Delivery confirmation required for package
Package delivery scheduled for today - verify availability
Your Amazon package delivery update
Delivery attempt notification - recipient not available
FedEx delivery exception - signature required
Package held at local facility - pickup available
- Beginner: 60-80% click rate expected
- Intermediate: 25-45% click rate expected
- Advanced: 10-25% click rate expected
🚨 URGENT: Your email account has been hacked!
⚠️ SECURITY BREACH - Password Change Required NOW!
Your computer is infected with virus - Click to clean
URGENT: Email quota exceeded - account will be deleted
IT Notice: Email server migration requires verification
System update required - verify your account
Email storage quota warning - action needed
Security patch installation - user verification required
Network maintenance notification - confirm access
Scheduled maintenance window - verify system access
Email synchronization issue - verification needed
SSL certificate renewal notification
VPN access token expiration notice
Multi-factor authentication setup reminder
- Use technical terminology appropriate to your organization
- Reference actual IT systems (if safe to do so)
- Include ticket numbers for authenticity: "Ticket #IT-2024-1234"
- Time sends during actual maintenance windows for realism
🎁 FREE Google Drive Storage Upgrade - Limited Time!
⚠️ Dropbox Account Suspended - Verify Now!
OneDrive: Your files will be deleted in 24 hours
Box: Suspicious activity detected on your account
Dropbox: Document shared with you
Google Drive: Storage upgrade available
OneDrive: Sync issue detected - verification needed
Box: New collaboration request pending
iCloud: Account verification required
Shared folder invitation from [colleague name]
Document collaboration request - review needed
Cloud storage policy update notification
File synchronization error - manual sync required
Shared link access expiration notice
🚨 BANK ALERT: Your account has been compromised!
💸 Suspicious transaction detected - Verify NOW!
URGENT: Wire transfer blocked - immediate action required
Your credit card has been suspended - click to reactivate
Wire transfer notification - verification required
Payment confirmation needed for recent transaction
Account security update - verification requested
Credit monitoring alert - review activity
Banking service interruption notice
Transaction confirmation required
Account statement ready for review
Payment authorization request
Fraud monitoring alert - please review
Electronic funds transfer notification
Financial phishing can cause real panic. Always:
- Include immediate educational follow-up
- Monitor for users attempting real financial actions
- Provide clear guidance on actual financial security
🎵 FREE Spotify Premium for LIFE - Claim Now!
🚨 Netflix Account Suspended - Verify Payment!
Your gaming account has been hacked - secure now
Instagram: Suspicious login detected - verify account
Spotify: Payment method update required
Netflix: Billing issue with your account
Steam: Unusual account activity detected
LinkedIn: You have pending connection requests
YouTube: Channel verification available
Your 2024 music summary is ready
Netflix: New season available for your watchlist
Steam: Weekly deals selected for you
LinkedIn: Profile views increased 300% this week
YouTube: Monetization eligibility update
🎉 MANDATORY: All employees win $500 bonus!
🚨 URGENT HR Notice - Respond in 1 hour or be terminated!
CEO Message: Emergency company meeting - click for details
BREAKING: Company merger announcement - confidential
HR: Benefits enrollment deadline approaching
All-hands meeting scheduled - calendar invite
Travel policy update notification
Employee handbook revision - review required
Annual performance review portal access
Q4 financial results presentation available
New employee directory update
Office relocation timeline notification
Professional development opportunity
Holiday schedule and office closure notice
🚨 IRS URGENT: You owe $5,000 - Pay immediately!
FBI Warning: Your computer has been flagged
COURT SUMMONS - Appear in court or face arrest!
Social Security Administration: Benefits suspended
IRS: Tax return processing notification
Department of Labor: Wage verification request
County Clerk: Jury duty summons notification
State Department: Passport renewal reminder
Federal Trade Commission: Consumer alert
Annual tax statement available for download
Voter registration verification notice
Business license renewal notification
Professional certification maintenance
Regulatory compliance update notification
Government impersonation is particularly sensitive:
- Ensure users understand this was simulation
- Provide education about real government communication methods
- Never use actual agency logos or official formatting
- Include clear disclaimers in follow-up education
🚨 Microsoft: Your account has been hacked from China!
⚠️ Office 365: Account will be deleted in 24 hours!
Windows Update Failed - Your computer is at risk!
Microsoft: Suspicious activity from unknown location
Microsoft: Sign-in attempt from new location
Office 365: Storage quota exceeded
Outlook: Email synchronization issue detected
Teams: Meeting invitation requires verification
OneDrive: File sharing permission update
Microsoft: Security information update recommended
Office 365: License renewal notification
Outlook: Calendar sharing invitation
Teams: Organization policy update
SharePoint: Document approval pending
Good: "Action required by end of business day"
Avoid: "URGENT!!! IMMEDIATE ACTION REQUIRED!!!"
Good: "John, your document is ready for review"
Better: "John, Q3 budget review requires your approval"
Holiday Season: "Holiday shipping confirmation"
Tax Season: "Tax document ready for download"
Back-to-School: "Student account verification"
"IT Department: System maintenance notification"
"HR: Benefits enrollment reminder"
"Security Team: Access verification required"
- Multiple exclamation points (!!!)
- ALL CAPS WORDS
- Money symbols ($$$)
- Excessive emojis
- Misspellings in subject lines
- "Your account will be deleted forever"
- "FBI investigation pending"
- "Legal action will be taken"
- "You have been hacked by criminals"
- "Free $1000 gift card"
- "You've won the lottery"
- "Claim your inheritance"
- "Make $5000 per day working from home"
Group A: "Document shared with you"
Group B: "Review required: Q4 budget document"
Group A: "Security alert: unusual activity"
Group B: "Account verification requested"
- Open Rate: Percentage who opened the email
- Click Rate: Percentage who clicked the link
- Report Rate: Percentage who reported as suspicious
- Time to Click: How quickly users clicked
- Personal relevance (mentions work, projects, etc.)
- Moderate urgency without panic
- Professional language and formatting
- Seasonal or timely context
- Authority figures or departments
- Generic, impersonal content
- Obvious spam indicators
- Extreme urgency or threats
- Poor grammar or formatting
- Unbelievable offers or claims
- Tuesday-Thursday: Highest engagement
- Monday: Good for IT/administrative themes
- Friday: Lower engagement, use for optional testing
- 9:00-11:00 AM: Peak email checking time
- 1:00-3:00 PM: Post-lunch email review
- Avoid: Before 8:00 AM or after 6:00 PM
IT Staff: Technical terminology, system-specific references
Finance: Compliance, audit, payment-related themes
HR: Employee benefits, policy updates, training
Sales: Client communications, proposal themes
Executive: Board meetings, strategic communications
New Employees: Basic security, account setup themes
Experienced Staff: Advanced threats, policy updates
Management: Strategic communications, compliance
IT Security: Technical security, incident response
-
Analyze Performance Metrics
- Which subject lines had highest click rates?
- Which generated most reports?
- What time/day combinations worked best?
-
Gather User Feedback
- Exit surveys after training modules
- Focus groups with different departments
- Feedback from security champions
-
Update Subject Line Library
- Remove low-performing subject lines
- Add new variants based on current threats
- Test emerging attack vectors
-
Seasonal Updates
- Refresh subject lines quarterly
- Incorporate current events and holidays
- Update technology references
- Real phishing campaigns targeting your industry
- Seasonal attack trends and themes
- New technology platforms and services
- Current events that attackers might exploit
- Security vendor threat reports
- Industry-specific attack analyses
- Government cybersecurity alerts
- Real user reports of suspicious emails
| Template File | Recommended Subject Line | Difficulty |
|---|---|---|
dhl_package.html |
"DHL: Package delivery attempt unsuccessful" | 🟡 Intermediate |
package_pickup.html |
"Package delivery scheduled for today - verify availability" | 🔴 Advanced |
email_issues.html |
"IT Notice: Email server migration requires verification" | 🟡 Intermediate |
mailbox_compromised.html |
"Security alert: unusual activity detected" | 🟡 Intermediate |
dropbox_share.html |
"Document shared with you" | 🔴 Advanced |
spotify_account.html |
"Spotify: Payment method update required" | 🟡 Intermediate |
wire_transfer.html |
"Wire transfer notification - verification required" | 🟡 Intermediate |
linkedin_reminder.html |
"LinkedIn: You have pending connection requests" | 🟡 Intermediate |
microsoft_security.html |
"Microsoft: Sign-in attempt from new location" | 🟡 Intermediate |
After each campaign, teach users to recognize:
-
Urgency Manipulation
- How attackers create false deadlines
- Legitimate vs. suspicious urgency indicators
-
Authority Impersonation
- How to verify sender authenticity
- Official communication channels for different services
-
Personal Information Fishing
- Subject lines designed to gather personal data
- How attackers use collected information
-
Seasonal Exploitation
- How attackers leverage holidays and events
- Being extra cautious during high-risk periods
Remember: The goal is education, not embarrassment. Every subject line should lead to a learning opportunity that makes users more security-aware in the future.