What is spear phishing?

The name comes from fishing. Ordinary phishing casts a wide net and catches whoever bites. Spear phishing picks one fish and aims straight at it. In cyber security, it is one of the most common ways attackers get their first foothold inside a company, because it targets people rather than technology. It is one type of social engineering attack.

What is phishing, and how does spear phishing differ?

Phishing is a message, usually an email, text or social media message, that pretends to come from someone trustworthy to trick you into doing something harmful. Spear phishing is the targeted version.

Whaling is spear phishing aimed at senior executives, the "big fish". Business email compromise (BEC) is a common form where criminals pose as a boss or supplier to get staff to pay money into the wrong account.

How a spear phishing attack works

1. Pick a target: often someone in finance, IT or HR, or anyone with access to money or systems.
2. Research: LinkedIn shows their job and manager, the company website names suppliers, and social media reveals holidays, events and writing style.
3. Craft the message: an email that looks like it comes from someone they trust, about something real, often from a lookalike address such as a misspelt company name.
4. Add pressure: urgency, secrecy or authority: "I need this paid before the board meeting, and keep it quiet for now."
5. The hook: a link to a fake login page, an attachment carrying malware, or a request to change bank details or send gift cards.
6. Cash in: stolen passwords open the email account or network, and money is moved on quickly through other accounts.

Spear phishing examples

A fake invoice from a real supplier

From:    Accounts <accounts@brightpack-supplies.co>
To:      Sam Patel, Finance
Subject: Updated bank details for invoice BP-4471

Hi Sam,

Following our audit, we've moved banks. Please use the new details
below for invoice BP-4471 (£18,240) due Friday. Can you confirm once
it's scheduled? Our old account will be closed this week.

Thanks,
Jo, BrightPack Supplies

This invented example has everything a real one would: a supplier the company really uses, a real-looking invoice number, the right contact's name and a believable reason. The tell is the sender's address, a lookalike domain, and the request to change bank details by email.

The boss who needs a favour

A message appears to come from a manager: "Are you at your desk? I'm in meetings all day and need you to buy some gift cards for a client. I'll pay you back. Don't call, just reply here." The urgency and the ban on calling are the giveaways: both stop you checking.

A real case: $120 million from two tech giants

Between 2013 and 2015, a Lithuanian man set up a company with the same name as a real Asian hardware maker that supplied two large US internet companies. Using phishing emails and forged invoices, he got the companies to wire more than $120 million to his accounts. He was jailed for five years in 2019, according to the US Department of Justice. If huge tech companies can be fooled, anyone can.

How big is the problem?

In its 2025 Internet Crime Report, the FBI recorded about $3.05 billion in losses from business email compromise in the US alone, out of about $20.9 billion in total reported cybercrime losses. The real figures are higher, because many victims never report.

Warning signs of spear phishing

• An unusual request, even from a familiar name: new bank details, gift cards, a password, or opening an unexpected file.
• Urgency or secrecy: "today", "before 5 pm", "don't tell anyone yet".
• A sender address that is almost right: an extra letter, a different ending such as .co instead of .com, or a personal email for a business matter.
• Links that don't go where they say: hover or long-press to see the real address before you tap.
• A login page you reached from an email. Go to the site yourself instead.
• A tone that feels slightly off, such as a manager who never writes like that.

Good spear phishing may have none of the old clues like bad spelling, and AI tools make polished, personal messages easy to write. So judge the request, not the polish.

How to protect yourself and your organisation

For everyone

1. Check through a second channel. If a message asks for money, data or access, contact the person another way, using a number or address you already have, not one in the message.
2. Never change payment details because of an email alone. Confirm by phone with someone you know at the company.
3. Use multi-factor authentication, ideally passkeys or a security key, which CISA recommends because they resist phishing.
4. Use a password manager. It won't fill in your password on a fake site, which is an early warning.
5. Share less publicly. Job details, org charts and travel plans all help attackers write convincing messages.
6. Report it. Tell your IT team at once, even if you clicked. Speed limits the damage.

For organisations

• Email authentication: set up SPF, DKIM and DMARC so others can't easily send email that appears to come from your domain.
• Payment controls: require a call-back check and two people to approve new or changed bank details and large transfers.
• Training and practice: teach staff the warning signs and run realistic practice exercises. The UK NCSC advises layering defences, because no single control stops every phishing email.
• An easy way to report: a report button and a culture where reporting a mistake is thanked, not punished.

Our Social Engineering course lets you practise spotting the red flags, reading where links really go and checking requests through a second channel. Try telling spear phishing apart from other attacks, then press Mark to check it in the course.

What to do if you fall for it

1. Report it straight away to your IT or security team, or your bank if money was sent. Banks can sometimes stop a transfer if told within hours.
2. Change the password you entered, and any account that uses the same one, then check MFA is on.
3. Disconnect a device from the network if you opened a suspicious attachment, and let IT check it.
4. Report it to the authorities: in the US to the FBI's IC3, and in England, Wales and Northern Ireland to Report Fraud, which replaced Action Fraud in December 2025. In the UK, forward suspicious emails to report@phishing.gov.uk.

Common mistakes

• Trusting a message because it uses your name and real details. That is exactly what spear phishing does.
• Replying to the email to check it is real. You are talking to the attacker. Use a contact method you already have.
• Thinking a padlock means a site is safe. It only means the connection is encrypted, and fake sites have padlocks too.
• Staying quiet after clicking. Delay helps the attacker. Report at once.
• Thinking only big companies are targets. Small businesses, schools and individuals are spear phished too.

Read next

Computer Science · CoursesSocial engineering course: spot and stop scamsA social engineering course in 24 short sections: why scams work, phishing, lookalike links, scam calls, deepfakes, and how to defend and report.