What Is Spear Phishing? Examples, Red Flags and Defenses

What is spear phishing? Learn how targeted phishing differs from whaling and BEC, how attackers research victims, key red flags and how to defend against it.

What is spear phishing? Spear phishing is a targeted form of phishing in which an attacker researches a specific person, team or company, then sends a personalized message, often posing as a colleague, manager, supplier or partner, to trick that target into sharing credentials, opening malware or making a payment. Personal detail is what makes it convincing.

Ordinary phishing casts a wide net; spear phishing aims at one fish. Below: how it differs from related attacks, how criminals research targets, examples, and defenses.

What is spear phishing? The definition explained

All phishing relies on impersonating someone trustworthy. Spear phishing adds research. Instead of a generic "Dear customer" email sent to millions of addresses, the attacker writes to a named person and refers to things that person will recognize: a real project, a real supplier, a recent trip, a manager's name or an internal system.

That context lowers the target's guard. A message that mentions the right invoice number or the right colleague does not feel like a scam, especially when it arrives during a busy working day. Spear phishing can arrive by email, but also by text, messaging apps, professional networking sites or phone calls.

Spear phishing vs phishing, whaling and BEC

These terms overlap, and people often use them loosely. A practical way to tell them apart:

• Phishing is the umbrella term: any attempt to deceive people by impersonating a trusted party. Most bulk phishing is untargeted and relies on volume.
• Spear phishing is phishing aimed at a specific individual or small group, using researched details to look legitimate.
• Whaling is spear phishing aimed at senior executives or other high-value people, such as board members, finance directors or anyone who can approve large payments or access sensitive data.
• Business email compromise (BEC) describes the outcome or method of many spear phishing attacks against organizations: criminals use a compromised or spoofed business email account to redirect payments or obtain data. The FBI's Internet Crime Complaint Center describes BEC as a sophisticated scam targeting both businesses and individuals.

In short, spear phishing is the targeted technique; whaling is spear phishing at the top of the organization; BEC is a common way that technique is turned into money.

How attackers research their targets

Spear phishing usually starts with open-source intelligence: information anyone can find. Common sources include:

• Company websites and press releases, which reveal names, job titles, office locations, partners, new contracts and events.
• Professional networking profiles, which show who reports to whom, who works in finance or HR, and who has just joined (new starters are a favorite target because they do not yet know normal processes).
• Social media posts about travel, conferences or team events, which give attackers a timely pretext such as "Following up from the conference last week".
• Email formats and signatures copied from genuine correspondence, newsletters or automatic out-of-office replies, which also reveal when a manager is away.
• Data from earlier breaches, including old passwords or personal details that make a message feel authentic.
• Compromised mailboxes. If an attacker already controls one account, they can read real conversations and reply inside an existing thread, which is especially hard to spot.

Attackers then set up infrastructure to match, such as a lookalike domain for a supplier (for example examp1e.com instead of example.com) or a cloned login page for a service the target uses every day. Our guide to typosquatting and homoglyph domains explains how these domains are built.

Spear phishing examples

These generic scenarios illustrate common patterns. They are not real cases.

• The changed bank details. An accounts payable clerk receives an email from what looks like a regular supplier: "We have moved banks; please use the new account for this month's invoice." The sender's domain differs from the real one by a single character.
• The shared document. A project manager receives a "shared file" notification that names a real partner and a real project. The link opens a fake sign-in page that captures their work password.
• The executive request. While the CEO is publicly listed as speaking at an overseas conference, a finance employee gets a short message "from" the CEO asking for an urgent, confidential payment or a batch of gift cards.
• The payroll update. HR receives a polite request from an "employee" to change the bank account for their salary before the next payroll run.
• The hijacked thread. A genuine conversation with a customer suddenly includes a reply asking for payment to a different account, sent from the customer's compromised mailbox.
• The recruiter. A specialist engineer is approached about a job and asked to open a "technical assessment" file that installs malware.

Red flags of a spear phishing message

Because spear phishing is personalized, the usual clues such as generic greetings or clumsy wording may be missing. Focus on the request and the context instead:

• A change to payment details or a request for an unusual payment, especially to a new account.
• Urgency combined with secrecy: "Handle this today and don't discuss it with anyone."
• A slightly wrong address: a lookalike domain, a personal webmail account, or a reply-to address that differs from the sender.
• A request to bypass normal process, such as skipping approval steps or using a new channel.
• Unexpected login prompts after clicking a shared document, invoice or voicemail link.
• A tone that is slightly off for the person who supposedly wrote it, or a request they would not normally make.

For a structured check of a suspicious message, see how to spot a phishing email.

How to protect yourself from spear phishing

• Verify through a second channel. If a message asks for money, data or credentials, contact the person using a phone number or address you already have, not the details in the message.
• Type addresses yourself rather than clicking login links in messages, or use bookmarks.
• Use a password manager. It will not autofill your password on a lookalike domain, which is a useful warning.
• Turn on strong multi-factor authentication, ideally passkeys or security keys, which are designed not to work on fake sites.
• Think about what you share publicly, such as travel plans, reporting lines and internal tools.
• Report quickly. If you clicked or replied, tell your IT or security team at once. Speed limits damage.

How companies defend against spear phishing

Organizations need controls that still work when one person is fooled:

• Payment verification rules. Require a call-back to a known number before changing supplier or payroll bank details, and dual approval for large or unusual payments.
• Email authentication. Publish SPF, DKIM and an enforced DMARC policy so criminals cannot send mail from your exact domain. See SPF, DKIM and DMARC explained.
• Phishing-resistant MFA. The US Cybersecurity and Infrastructure Security Agency recommends phishing-resistant MFA based on FIDO/WebAuthn, starting with high-value accounts.
• External email tagging and mailbox monitoring, including alerts for new forwarding rules, which attackers often create after taking over an account.
• Targeted training for finance, HR, executive assistants and new starters, using realistic scenarios rather than generic examples, plus an easy way to report. For Microsoft 365 users, see how to report phishing in Outlook.
• Lookalike domain monitoring and takedowns. Spear phishing often depends on domains that imitate your company or your suppliers. Detecting them early and having them suspended or blocklisted removes the attacker's infrastructure before it is used. Our phishing site takedown process guide shows how that works.

If you spot a fake site or domain imitating a company, report a phishing site to Phishvoid. If you manage a brand, book a free exposure scan to find lookalike domains and cloned pages that could be used against your staff, partners or customers. We act only with the brand owner's written authorization.

FAQ

What is spear phishing in simple terms?

It is a personalized phishing attack. The criminal researches a specific person, then sends a believable message, often from someone they seem to know, to steal credentials, install malware or get a payment.

What is the difference between spear phishing and whaling?

Whaling is a type of spear phishing that targets senior executives or other people with significant authority over money or sensitive data.

Is spear phishing the same as business email compromise?

Not exactly. Spear phishing is the targeted deception technique. BEC refers to scams that use a compromised or spoofed business email account, typically to redirect payments. Many BEC attacks begin with spear phishing.

Why is spear phishing so effective?

It uses real names, projects and relationships, so messages feel normal. It also targets people whose jobs involve handling payments, documents or access requests every day.

Can email filters stop spear phishing?

Filters help, but a small number of carefully written messages from a new lookalike domain or a compromised real account can get through. Process controls, verification and fast reporting are essential.