October is Cybersecurity Awareness Month, so most inboxes already hold a reminder about suspicious links, a quiz or two, and at least one poster warning about urgent requests from the CEO. It's also the start of Q4, when planning documents circulate, the quarterly all-hands gets scheduled, and every team suddenly needs something from every other team. People spend October primed to spot the email that feels wrong. The emails that get through this month don't feel wrong. They feel like being a good colleague.
That's the thread through this month's five. None of them threaten anything. Each asks for a small act of cooperation, and each leans on a different reason you'd go along with it: letting someone into a file, getting ready for a meeting, giving to a good cause, keeping your signature on-brand, and catching up on something everyone else has seen. The callout on each template names the lever, so your team learns to spot the pull rather than the branding.
Download these phishing templates for your in-person security awareness training materials! And check out this list of best phishing simulation tools 2026
Nobody wants to be the reason someone else's work is stuck.
The Hook: A SharePoint Online notification, subject Access Request: Q4 Planning Draft v3, says someone in your organisation has asked for edit access to a file you own, and that pending requests expire after seven days. With planning documents moving between teams, a request like this is easy to believe, even if you can't quite place the file. The "Review Request" button asks for nothing risky. It asks you to stop holding things up.
Real-World Risk: "Review Request" opens a spoofed Microsoft 365 sign-in, dressed as the SharePoint sharing page, that asks you to authenticate before you can see who's asking. The credentials go straight to the attacker, and the account behind a Q4 planning file usually reaches a lot more than one document.
Learning Moment: Before approving anything, work out who actually needs access and why. Open SharePoint directly and check the request through its own access-management tools rather than the email, and if you don't recognise the file or the person asking, a message in your team channel settles it. A request feels urgent because someone is apparently waiting, and that's the part an attacker can fake for free.
Anything that saves you fumbling with cables in front of a full room is an easy yes.
The Hook: An email from Workplace Technology, subject Pair Your Account Before Your Room Booking, says your room now has a new Teams display and asks you to pair your account in advance by entering a code, HX7K2QW9P, on Microsoft's device sign-in page. It warns that the code expires in 15 minutes. Q4 brings plenty of planning sessions and reviews, so lots of people will have a room booked for something. The request reads as preparation rather than a problem, and the "Pair Now" link points to a genuine Microsoft address.
Real-World Risk: This is device code phishing. The code doesn't belong to a meeting room; the attacker requested it from their own machine moments before sending the email, and it stays valid for fifteen minutes from that request, which is why the email pushes for speed. Entering it on Microsoft's real page and confirming your account signs the attacker's session in as you, MFA included, without a password ever touching a fake page. CrowdStrike's 2026 Threat Hunting Report found that monthly device code phishing attempts increased fifteen-fold in the first half of 2026.
Learning Moment: Entering a device code approves a sign-in happening on another device, so the rule is simple: only complete a device sign-in you deliberately started, on a screen in front of you. A code that arrives unprompted in an email was requested by someone else. And a genuine web address tells you where you are, not who's asking.
It's hard to be suspicious of an email that wants you to do some good.
The Hook: A message from Community & Giving, subject Double Your Donation Before 31 October, says the company will match every donation made through the giving portal this month in full. The tone is warm and the timing makes sense, since matching campaigns as the year winds down are common enough to be believable. The deadline adds a gentle push without anyone feeling pressured, and the "Choose a Charity" button feels like the start of something kind rather than a login.
Real-World Risk: "Choose a Charity" opens a spoofed giving portal, in the style of Benevity, behind a company SSO prompt, and the credentials are harvested on entry. Some versions then ask for a pledge by card "so the match can be applied", which adds payment details to the haul.
Learning Moment: The question to ask is whether you've reached your company's genuine giving service. If your organization runs a matching program, it will be listed on the intranet or in the platform you'd normally use, so start there and check the campaign exists. Nothing about this should put anyone off giving; the only thing that changes is where you start.
Being asked to match everyone else is one of the easiest requests to say yes to.
The Hook: An email from the Brand Team, subject Your New Email Signature Is Ready, says signatures have been refreshed for Q4 and asks everyone to switch by 31 October so the company looks consistent in front of customers. There's a small social pull in it, because nobody wants to be the one still sending the old logo after everybody else has switched. The "Generate Signature" link promises a two-minute job with a tidier result at the end.
Real-World Risk: The link opens a spoofed signature generator, styled like Exclaimer or CodeTwo, that asks you to sign in with Microsoft 365 "to pull your details from the directory". The credentials are harvested, and the form that follows asks for your job title, direct line and mobile number, which gives a follow-up call or text pretending to be IT something to work with.
Learning Moment: The detail worth teaching here is the extra ask. A tool that claims to have your directory details already has no obvious reason to need your mobile number, so treat that as the moment to stop and check with the brand or marketing team through your usual channel. A request can be low-stakes for you and still useful to someone else: your mobile number is a small detail until someone uses it to call you as the service desk.
Missing the all-hands is easy. Feeling like the only person who missed it is what gets the click.
The Hook: An email from Internal Communications, subject Q3 All-Hands: Recording and Slides Now Available, says the recording, slides and full Q&A from this quarter's all-hands are up for anyone who couldn't attend, and that recordings are kept for seven days. In plenty of organisations the Q3 update lands around now, and the content is deliberately neutral, with no hints about results. "Watch Recording" is the kind of button people press without thinking.
Real-World Risk: The button opens a spoofed Microsoft Stream or SharePoint page that asks you to sign in to play an internal video. The recording doesn't exist, and the credentials are harvested on entry. A sign-in for "internal-only" content looks like a sensible control, so it's unlikely to raise a flag.
Learning Moment: This one is about pressure: the seven-day expiry, plus the sense that everyone else has already watched it. Name that feeling with your team, because being slightly behind is a lever in the same way urgency is. Then find the recording where your organizaion actually keeps them, whether that's the intranet, the channel the meeting was held in or your usual video platform.
The Good Colleague Problem
None of this month's templates threaten anyone. They ask for what a decent colleague does without thinking: let someone into a file, turn up prepared, give to a good cause, keep the brand tidy, keep up with the company. During Awareness Month people are watching for the email that feels hostile, and the cooperative ones tend to get far less attention.
So the habit worth teaching keeps people helpful. It only changes where they start: SharePoint rather than the notification, a sign-in they began themselves, the giving portal on the intranet, the brand team's own channel, the place recordings actually live. You can be a good colleague without taking the email's word for it. And when something doesn't check out, report it through whatever your organisation uses for suspicious messages, because the person who spots one is rarely the only person who received it.
Explore our phishing simulation library and pick the variations that best match the tools your team actually uses.
Want to explore more? Browse our blog for additional templates, and stay ahead of cyber threats with our curated training resources.
Ready to level up? Register for a free trial of Wizer Boost to access our full library of phishing templates and exercises!
Learn how to set up your first simulation in minutes.