Spear Phishing: How to Spot and Stop Targeted Phishing Attacks

The name comes from spearfishing: instead of casting a wide net, the attacker aims at a single fish. That is why you also see the spelling "spearfishing". Because the message feels personal, it is much harder to spot than a mass email.

Spear phishing vs. phishing, whaling and CEO fraud

These terms are closely related. Here is how they differ:

• Phishing: Mass emails to many people, such as a fake delivery notice. Attackers rely on volume.
• Spear phishing: One person or a small team is targeted. The message names people, projects or coworkers.
• Whaling: Spear phishing aimed at executives, such as the CEO or CFO. They hold broad access and can approve payments.
• Business email compromise (BEC): Attackers use a real, hijacked mailbox or pose as a trusted partner. The goal is usually money, for example by changing the bank details on an invoice.
• CEO fraud: A type of BEC. The attacker poses as the boss and asks for an urgent, confidential transfer.

Spear phishing does not only arrive by email. Text messages (smishing), messengers, phone calls and business networks are used too.

How a spear phishing attack works

1. Pick a target: Attackers look for people with access to money, data or systems. These are often finance, HR, IT or executive assistants.
2. Do research: Using OSINT, they gather public information. Sources include the company website, business networks, press releases, job ads and company registers.
3. Write the message: With this knowledge, they craft a believable email. It may mention a current project, a real supplier or an upcoming trade show.
4. Add the hook: The message contains a link to a fake login page, an attachment with malware or a payment request.
5. Cash in: The attackers log in with stolen credentials. Or the malware opens a path into the network. Or the money has been sent.

Our article on social engineering explains the psychology behind these tricks.

How to spot spear phishing

Well-made messages no longer have spelling errors. So watch for these signs instead:

• Pressure and urgency: "Please handle this today", "I'm about to go into a meeting".
• Secrecy: You are told not to involve anyone, not even your manager.
• Unusual channel: A request that never normally comes by email, such as new bank details or gift cards.
• Odd sender details: The domain is slightly off, such as one swapped letter. Or the reply-to address differs from the sender.
• Unexpected login pages: A link leads to a sign-in page even though you did not ask for anything.
• Wrong tone: The greeting or style does not match how that person usually writes.

Technical defenses

• SPF, DKIM and DMARC: These standards make it harder to fake email from your own domain. They do not help against lookalike domains.
• Multi-factor authentication (MFA): A stolen password alone is no longer enough to sign in. Phishing-resistant methods such as FIDO2 keys protect better than SMS codes.
• Email filters: They scan links and attachments and block known malware.
• External email tags: A banner such as "External sender" makes fake internal emails stand out.

Organizational defenses

• Payment approval rules: Large transfers and changed bank details need a second approval.
• Call back on a known number: Check unusual requests by phone. Use the number from your own contacts, never the one in the email.
• Awareness training: Staff learn to recognize the warning signs. See our cyber awareness training.
• Phishing simulations: Realistic test emails show where gaps remain. Our phishing simulator helps with this.
• Share less in public: Check which names, roles and internal processes really need to be on your website.

The goal is a human firewall: staff who spot suspicious messages and report them.

What to do if you suspect an attack

1. Do not click links or open attachments.
2. Do not reply to the email.
3. Report the message to IT or the security team right away, for example with a report button.
4. Already clicked or entered data? Say so at once. Change your password and have the device checked.
5. Has money been sent? Tell your bank immediately so it can try to recall the payment. Also report the crime to the police.

Reporting fast matters more than feeling embarrassed. The sooner IT knows, the sooner it can warn other users and lock accounts.

Frequently asked questions

Is "spearfishing" the same as spear phishing?

In IT, yes. "Spearfishing" is a common spelling for the same attack. Strictly speaking, spearfishing means fishing with a spear, which is where the term comes from.

Who is most at risk?

Mainly people with access to money, HR data or systems. That includes finance, HR, IT admins and senior management. Staff with many outside contacts, such as purchasing, are also frequent targets.

Is a spam filter enough to stop spear phishing?

No. Targeted emails often contain no known malware and sometimes come from real, hijacked accounts. Filters catch some of them. Clear processes and alert staff need to catch the rest.