In this article:
Spear phishing is a targeted cyberattack where bad actors send custom, personalized messages to a specific person or group within an organization. These messages differ from mass phishing emails you may be accustomed to seeing. Spear phishing emails are specifically personalized to make them more convincing.
Given the serious consequences of a spear phishing attack, it's important to know how scammers might identify you, what these messages look like and the warning signs to look for to avoid becoming a victim.
What Is Spear Phishing?
Spear phishing is a targeted type of phishing scam designed to trick a specific person or organization into giving up personal or financial information. Scammers use spear phishing messages to steal sensitive company information or intellectual property, or to get access to a business's internal network for further attacks.
Unlike a mass phishing email that sends the same message to thousands or even millions of people, a spear phishing email is targeted to a particular person, business or organization. A scammer combs through social media profiles, company websites and information found through data breaches, among other resources, to find target email addresses. They then use that data to impersonate a trusted person or business to trick you into giving up personal or financial information.
You might receive a customized email impersonating a coworker or boss, urging you to take a specific action like reviewing an attached document and getting back to them. Once you open the seemingly harmless file, malware is installed on your device.
Phishing vs. Spear Phishing vs. Whaling
General phishing typically sends the same message to a large group of people, while spear phishing targets a specific person or organization. As its name implies, whaling is a type of spear phishing that targets a company's executives or other high-profile individuals.
| Phishing | Spear Phishing | Whaling | |
|---|---|---|---|
| What it is | A type of cyberattack that uses fraudulent messages to steal sensitive information | A targeted phishing scam that uses more personalized and deceptive tactics to appear legitimate | A spear phishing attack aimed at the "big fish" in an organization |
| Who it targets | General public en mass | A specific person, department, business or organization | High-profile individuals and senior executives |
| Personalization | Little or no personalization | Exploits personal information and may mention actual coworkers, team projects or software you use to seem real | Uses detailed information about the executive and may mimic how they communicate |
How Does Spear Phishing Work?
Spear phishing tactics use customized and deceptive messages to carry out a scammer's objectives. Here's how it usually works.
1. Target Selection
Who a fraudster decides to target largely depends on their objective. For example, if a cybercriminal wants to steal a large amount of money, they may target an employee who's likely to have access to banking details, such as someone in the finance department who handles company payments. They also target lower-level and newer employees who may have broad access to company systems, but may be less stringent when it comes to security procedures.
2. Reconnaissance
Scammers generally research their targets by searching online or browsing through social media and professional websites. They look for useful details about the target's job and coworkers, anything they can use to appear more trustworthy.
3. Message Preparation
Armed with the personal data they've gathered, scammers pose as someone the target trusts to create a convincing message or email. The message may match that person's writing style or even use deepfakes to make it sound or look like them.
4. Delivery and Interaction
Once the fraudster has identified their target and prepared a spear phishing strategy, the next step is to send the message. Scammers will go to great lengths to carry out the scam, even messaging the target for several weeks before making a request for data or asking them to click through a link.
Some messages are meant to steal information. For example, the spear phishing message could include a request for confidential information or a link to a fake login page that captures your credentials. Other scams are designed to infect a device or computer system. They could include an attachment that infects your system with ransomware or malware when you open it.
5. Exploitation
Once a spear phisher has the access or information they're looking for, they may use one compromised account to access other parts of the company's systems and steal confidential information. They can also use the information for fraudulent transactions or to launch more attacks.
If a scammer steals your login credentials, they may be able to take over your email or bank accounts. They can also use your personal data to steal your identity or sell that information to other criminals.
Note: Phishing and spoofing cost victims $215.8 million in 2025, more than three times the losses reported a year earlier, according to the FBI.
Examples of Spear Phishing
Spear phishing messages are designed to look like real requests you get from people or companies you know. But the devil is in the details. Here are some examples of common spear phishing attacks to look out for.
- Fake CEO email: You may receive a legitimate-looking message from an executive at your company asking you to send money or sensitive files.
- Fake IT support message: A scammer may impersonate someone from your IT department announcing a routine password reset. The link included in the message points to a fake login page that captures your credentials.
- Fake vendor invoice: Another common spear phishing message is one that comes from a company you regularly use that says its payment information has changed. The message typically includes an invoice with payment instructions for a new account controlled by the scammer.
- Fake bank fraud alert: You've likely seen this one before: a text or email notifying you of a suspicious charge or purchase and asking you to click a link to verify your account. The link can lead to a fake bank website designed to steal your account's login credentials.
- Fake recall alert: Let's say you buy a new refrigerator using your credit card from a major retailer. Shortly after, the company suffers a data breach, and a hacker has your name and contact information, but your credit card information is encrypted or only shows the last four digits. To get that credit card number, a spear phisher may pose as the retailer notifying you of a recall of your refrigerator model. The notice includes details of your purchase to build trust, then sends you to a recall page where you're asked for your credit card number. If you supply it, the scammer has everything they need to use your credit card to rack up charges.
Learn more: The Latest Scams You Need to Be Aware Of
Warning Signs of Spear Phishing
Because the consequences of spear phishing can be financially and personally devastating, it's essential to know the red flags of spear phishing.
- Unexpected or unusual requests: One of the biggest tipoffs is when the email sender makes inappropriate requests for personal, financial or security information.
- Suspicious sender details: Phishing emails use addresses with slight variations from the real address.
- Urgency or pressure: Scammers commonly aim to create fake urgency or use emotional pleas to pressure you to act fast without thinking about the consequences of doing so.
- Requests sensitive information: Legitimate companies and coworkers don't ask for money, passwords or personal details by email or text.
- Unexpected links or attachments: For example, if you didn't initiate a password reset, an email from your bank asking you to reset your password should give you pause. Even a file or link from someone you know could be malicious if their account has been compromised.
- Personal details used as trust builders: Messages that address you by name or include information about your boss or other personal details doesn't necessarily make a message legitimate. Remember, such personal information is easy to find in social media posts and breach data.
How to Protect Yourself From Spear Phishing
Spear phishing messages can be difficult to recognize because they're purposely designed to look legitimate. Limit your risk by taking steps to avoid the scam and protect your accounts.
- Verify unusual requests. Whenever you receive an unusual request, confirm it's legit by a method you trust. Call the person at a number you already have stored rather than using the method included in the message.
- Check the sender details carefully. Always scrutinize the sender's email address letter by letter. Scammers set up email addresses meant to look like a real person or company using a variety of tricks. For example, payroll@cornpany.com can look like payroll@company.com because the r and n together resemble an m.
- Hover over hyperlinks. The true test to find out where a link leads without clicking on it is to hover the cursor over it to reveal the real destination. Be aware that spear phishers often use fake subdomains. For example, yourcompany.com is real, but yourcompany.com.private-login.com is a scammer's site.
- Enable multifactor authentication (MFA). MFA requires two or more forms of verification to access an account. Anyone attempting to log in must enter at least one additional form of verification, such as a randomly generated code or approval through an authentication app.
- Be careful about what you share. Limit what you share online and in messages. Scammers use social media networks to discover details about your job and other personal information they can use. Also, lock down your privacy settings to only include people you know.
- Don't share sensitive information by message. Legitimate companies generally don't ask you to send personal or financial information by email or text.
Learn more: How to Avoid Phishing Scams
What to Do if You're the Victim of a Spear Phishing Attack
If you think you've fallen for a spear phishing attack, act quickly to limit the damage.
- Disconnect and stop interacting. Close the message without responding or entering any information. If you clicked a link or opened an attachment, leave the website or close the file right away. Better yet, disconnect your device from the internet immediately to stop malware from downloading or sending information from your device.
- Change compromised passwords. Create a new password with the targeted account as soon as possible using another device you're certain isn't infected. Then update any other accounts that share that password, or a similar-sounding one.
- Report the incident. Alert your IT or security team immediately. Also notify any financial institutions where your accounts may be at risk. Consider filing a report with the Internet Crime Complaint Center (IC3), an agency run by the FBI, which investigates cybercrimes. You may also want to inform the Federal Trade Commission (FTC) to help investigators track down scammers. Forward suspicious emails to the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org, which tracks phishing campaigns.
- Review your accounts for suspicious activity. Check bank and card statements for charges you don't recognize. Also review your credit report and look for new accounts or hard inquiries you didn't authorize.
- Secure your accounts. Multifactor authentication is now a standard security feature at most banks and other companies that handle sensitive information. Always enable this feature where it's available. You also have the right to place a fraud alert or credit freeze on your credit to help prevent a scammer with your information from opening new credit accounts in your name.
Find Out if Your Information Is on the Dark Web
Spear phishers rely on personal information they gather from a variety of online sources to make their messages more convincing. One place these fraudsters commonly turn to is the dark web, because it includes details about you or your accounts that have been exposed in data breaches. Consider getting a free dark web scan with Experian to find out if your personal information has been found on the dark web so you can take steps to protect your accounts and identity.