What is spear phishing? Definition, examples and how to stop it
What is spear phishing, and why does it get past people who would never fall for a fake parcel text? Because it is written for them. This guide gives a clear spear phishing definition, shows how attackers research and target finance teams and executives — including whaling and business email compromise — walks through lures your staff will recognise, and sets out the controls and register entries that actually reduce the risk.
Spear phishing is a targeted phishing attack aimed at a specific person or small group, using research about their role, colleagues, suppliers or current work to make a fraudulent message look routine. Its aim is usually to steal login details, install malware or get a payment made. Whaling is spear phishing aimed at senior executives; business email compromise (BEC) uses a fake or hijacked business email account to redirect money. Because the messages are tailored, filters and generic training catch fewer of them. The controls that work best do not rely on spotting the lie: verifying payment changes by phone on a known number, dual approval of payments, phishing-resistant multi-factor authentication and fast reporting.
Put this into a living risk registerRisk Samurai gives you a ready-made register: score risks on your own scales, assign owners and track actions, with no spreadsheet to maintain.
Get early accessSpear phishing definition
Phishing in general is any message that impersonates someone you trust to trick you into handing over credentials, money or access. Our phishing guide covers the whole family, from mass email to smishing and QR codes. Spear phishing is the targeted branch of that family: the attacker chooses who to attack first and then writes the message for them.
The name is the metaphor: a net catches whatever swims into it; a spear is thrown at one fish. In practice spear phishing combines three things:
- A chosen target — usually someone who can pay money, change bank details, reset access or reach valuable data.
- Research — names, roles, suppliers, projects, writing style, travel plans and approval limits.
- A plausible pretext — a request that fits naturally into the target’s week, often with time pressure.
MITRE ATT&CK, the widely used catalogue of attacker techniques, files these under Phishing (T1566) with sub-techniques for spearphishing attachments, links, messages via third-party services such as LinkedIn or Teams, and voice. Its separate “phishing for information” technique (T1598) covers the reconnaissance messages that often come first.
Spear phishing vs phishing, whaling and BEC
| Type | Who is targeted | How it is built | Typical goal |
|---|---|---|---|
| Phishing (bulk) | Anyone and everyone | One generic message sent widely | Credentials, malware, card details |
| Spear phishing | A named person or small group | Researched, personalised message | Credentials, access, payment |
| Whaling | Directors, executives and their assistants | Spear phishing at the top — or impersonating the top | Large payments, sensitive data |
| Business email compromise | Finance, payroll, accounts payable, conveyancing | Spoofed, look-alike or hijacked real email account; often no link or attachment | Redirected payments |
| Clone phishing | Recipients of a genuine earlier email | Copy of a real message with a malicious link swapped in | Credentials, malware |
| Vishing / deepfake calls | Helpdesks, finance staff, executives | Phone or video call, sometimes with a cloned voice or face | MFA resets, payments |
How a spear phishing attack works
Most targeted attacks follow the same five stages. Knowing them shows where you can interrupt the chain.
| Stage | What the attacker does | Where you can interrupt |
|---|---|---|
| 1. Reconnaissance | Reads your website, LinkedIn, Companies House or ASIC filings, press releases, job adverts, out-of-office replies and social media to map who approves what | Limit public detail on finance roles and approval processes; generic out-of-office messages |
| 2. Pretext and infrastructure | Registers a look-alike domain, compromises a supplier’s mailbox, or prepares a fake sign-in page or document | DMARC on your own domain; monitoring for look-alike domains; supplier security checks |
| 3. Delivery | Sends a tailored email, Teams or LinkedIn message, text or call — often timed for when the impersonated person is travelling | Email filtering; external-sender tagging; warnings on new senders |
| 4. Exploitation | The target enters credentials, approves an MFA prompt, opens a file or changes bank details | Phishing-resistant MFA; payment verification; dual approval |
| 5. Monetisation and persistence | Moves money, sets mailbox forwarding rules, reads email to plan the next fraud, or deploys ransomware | Alerts on new forwarding rules and unusual sign-ins; fast reporting; bank recall |
Generative AI has made stages 1 and 3 cheaper. Attackers can summarise a target’s public footprint in minutes and write fluent, error-free messages in any style. Poor spelling is no longer a reliable sign of anything.
Whaling: when the target is the top
Whaling works in two directions. Attackers target executives because they have authority and access, and they impersonate executives because staff rarely question them. The second pattern — a message apparently from the managing director to a finance assistant — causes most of the losses in small companies.
Deepfakes have extended this beyond email. In early 2024 Hong Kong police reported that an employee of the engineering firm Arup transferred about HK$200 million (roughly US$25 million) after a video call in which the company’s chief financial officer and other colleagues were impersonated with deepfakes. A small business does not need to fear a video production of that scale to learn the lesson: a familiar voice or face on a call is no longer proof of identity, so payment authority must not depend on recognising someone.
Practical whaling defences:
- Executives agree in writing that they will never ask for an urgent, confidential payment by email, message or call — and that staff who verify such requests will be thanked, not blamed.
- A verification step for any unusual request from a senior person: call back on a known number, or ask a question only the real person could answer.
- Phishing-resistant MFA on executive accounts first; they are the accounts attackers most want.
- Executive assistants included in targeted training — they often hold delegated access.
Business email compromise and finance teams
Business email compromise is where spear phishing turns directly into money. The FBI’s Internet Crime Complaint Center, which publishes the largest public dataset on reported cybercrime losses, puts BEC among the costliest categories year after year; its report for 2025 recorded around US$3 billion in BEC losses in the United States alone. Small companies are attractive because they often have fewer approval steps and one person who can both change supplier details and release payments.
The common patterns:
- Supplier bank detail change. A real supplier’s email account is compromised, or a look-alike domain is used, to send an invoice with “new” bank details.
- CEO or director fraud. An urgent, confidential request for a payment, often while the director is travelling.
- Payroll diversion. “HR, I’ve changed banks — please update my salary details before this month’s run.”
- Property and legal payments. Conveyancing and completion funds diverted by an email that appears to come from the solicitor or estate agent.
- Reply-chain hijack. The attacker replies inside a genuine, ongoing email thread from a compromised account, so everything above the message is real.
The one control that matters most: any new or changed bank details are confirmed by phone using a number from your own records — never one in the email or on the new invoice — and a second person approves the change before any payment goes out.
Recovery is time-critical. Money moved by bank transfer is often onward-transferred within hours, so the procedure must say who calls the bank and how. In the UK, the mandatory reimbursement scheme for authorised push payment fraud introduced in October 2024 covers consumers, micro-enterprises and charities for Faster Payments up to £85,000 per claim; larger businesses are outside it and should assume they will bear the loss. In both the UK and Australia, check what your bank’s payee name-checking service and your cyber insurance actually cover before you need them.
Spear phishing examples: lures to recognise
These are composite examples of patterns seen widely; the details will differ in your business.
| Lure | Who receives it | What gives it away | Control that stops it |
|---|---|---|---|
| “Please note our new bank details for all future invoices” from a regular supplier | Accounts payable | Change of bank details by email; sometimes a slightly different domain | Call-back on known number; dual approval |
| “Are you at your desk? I need a quick favour — keep this between us” from the MD | Finance or office staff | Secrecy, urgency, unusual channel; may ask for gift cards | Executive “we will never ask” rule; verification |
| Shared document from a real client about a real project, asking you to sign in to view | Account managers, project staff | Sign-in page after clicking; client did not mention it by phone | Phishing-resistant MFA; report button |
| Call from “IT support” asking you to approve an MFA prompt or install a remote tool | Any staff; helpdesk | Unexpected call; pressure to act now | Helpdesk identity verification; no MFA approvals on request |
| Helpdesk receives a call from “a director” locked out while travelling | IT helpdesk or outsourced provider | Request to reset MFA or password without normal checks | Strict reset procedure with call-back to the registered number |
| Recruiter message on LinkedIn with a “job description” attachment | Engineers, IT administrators | File that needs macros or a password; move off-platform | Application control; macro restrictions |
| “Updated payroll details” from an employee’s personal email address | HR, payroll | Change via email rather than the HR system | Changes only through the HR system, verified in person or by call |
| Reply in an existing invoice thread: “Please hold the payment, our account is under audit — use this one instead” | Accounts payable | Change of instructions mid-thread | Call-back; alerts on supplier detail changes |
| Your accountant’s “year-end documents” link in a busy month | Directors, finance | Generic file-sharing page asking for your email password | Password manager won’t autofill on the wrong domain; MFA |
| Voice message or call in the director’s voice approving an urgent transfer | Finance | Payment request outside normal process; insistence on speed | Payment authority never based on voice alone; call back |
Why spear phishing beats filters and training
- No malicious payload. A plain-text request to change bank details has no link or attachment for a filter to block.
- Trusted senders. A message from a genuinely compromised supplier account passes authentication checks such as SPF, DKIM and DMARC.
- Context beats caution. The message is about a real project, a real supplier and a real deadline.
- Authority and urgency. Few junior employees want to slow down a director.
- Training targets the wrong signs. Lessons about bad grammar and odd logos do not help with fluent, well-researched messages.
That is why the strongest defences are processes that work even when someone believes the message.
Controls that reduce spear phishing risk
| Control | What it stops | Notes |
|---|---|---|
| Call-back verification of bank detail changes and unusual payments | Most BEC and whaling losses | Use a number from your own records; write it into the finance procedure |
| Dual approval of payments and supplier changes | Single-person mistakes under pressure | Separate the person who changes details from the person who pays |
| Phishing-resistant MFA (passkeys, FIDO2 security keys) | Credential theft, including real-time phishing proxies that defeat codes and push prompts | Start with email, finance systems, admin and executive accounts |
| DMARC at enforcement on your own domain | Attackers sending email that exactly spoofs your domain | Does not stop look-alike domains or compromised supplier accounts |
| External-sender and new-sender warnings | Look-alike domains and impersonation | Keep the banner short or people stop seeing it |
| Alerts on mailbox forwarding rules and unusual sign-ins | Attackers silently reading email after a compromise | Available in most business email platforms |
| Strict helpdesk identity checks | Voice-based MFA and password reset fraud | Apply to outsourced IT providers as well |
| One-click reporting and a no-blame culture | Slow detection | A report in the first minutes limits the damage for everyone else |
| Role-based training and realistic exercises | Over-trust in context and authority | Focus on finance, HR, executives, assistants and the helpdesk |
| Less public detail about approval processes | Easy reconnaissance | Keep job adverts and website staff pages free of who approves payments |
Spear phishing is also a supplier risk: a compromised supplier mailbox is one of the most convincing delivery routes. Include email security in your third-party risk assessment for suppliers who invoice you or handle your data, and treat phishing as one threat within your wider cybersecurity risk assessment.
What to do when a spear phishing attack succeeds
- Report internally straight away — speed matters more than embarrassment.
- If money was sent, call your bank now and ask it to contact the receiving bank to freeze or recall the funds.
- Contain the account: reset the password, revoke active sessions and tokens, re-register MFA and check for new forwarding rules, inbox rules and connected apps.
- Check for wider impact: who else received the message, what data the account could reach, and whether other payments are pending.
- Report the crime. In England, Wales and Northern Ireland use Report Fraud (the service that replaced Action Fraud in December 2025); in Scotland, Police Scotland on 101. Forward suspicious emails to the NCSC at report@phishing.gov.uk. In Australia, report through ReportCyber at cyber.gov.au.
- Assess notification duties. If personal data was exposed, UK and EU GDPR require notifying the regulator within 72 hours of becoming aware where the breach poses a risk to individuals — see our data breach response plan.
- Learn from it. Update the register, the procedure and the training with what actually happened.
Spear phishing in the risk register
Write spear phishing risks around what is lost, not the technique, and score them on the same risk matrix as everything else in your risk register.
| Risk statement | L | I | Score | Key controls | Owner |
|---|---|---|---|---|---|
| Fraudulent change of supplier bank details leads to payments sent to criminals | 3 | 4 | 12 | Call-back verification; dual approval; supplier change alerts | Finance director |
| Impersonation of a director leads to an unauthorised urgent payment | 2 | 4 | 8 | “We will never ask” rule; payment limits; verification | Managing director |
| Targeted credential phishing gives an attacker access to email and customer data | 3 | 4 | 12 | Phishing-resistant MFA; sign-in alerts; reporting button | IT lead |
| Helpdesk is tricked into resetting MFA for an attacker | 2 | 5 | 10 | Identity verification procedure; call-back; logging of resets | IT lead |
| Payroll details changed by a fake employee request | 2 | 3 | 6 | Changes only via HR system; verification | HR manager |
Scores are illustrative residual scores. Useful key risk indicators: percentage of bank detail changes verified by call-back, time from a suspicious email to the first report, share of privileged accounts with phishing-resistant MFA, and number of new mailbox forwarding rules investigated.
Common mistakes
- Relying on staff to spot the fake. Well-researched messages are hard to spot; build processes that work anyway.
- Exceptions for senior people. “The MD doesn’t need to follow the payment procedure” is exactly what attackers exploit.
- Verifying with the attacker. Calling the number on the fraudulent invoice, or replying to the email, confirms nothing.
- SMS codes as the end state. Any MFA beats none, but codes and push prompts can be phished in real time.
- Blaming the clicker. People who fear blame report late, and late reports cost money.
- Ignoring suppliers. Your controls can be perfect and a supplier’s compromised mailbox can still deliver the lure.
Frequently asked questions
What is spear phishing in simple terms?
A phishing attack aimed at a specific person or small group, written using research about their role, colleagues, suppliers or current work so that it looks like a normal part of their day. The goal is usually to steal login details, install malware or get a payment made.
What is the difference between phishing and spear phishing?
Ordinary phishing sends one generic message to many people and relies on a few responding. Spear phishing is tailored to a chosen target, so there are far fewer messages but each is more convincing and harder for filters and training to catch.
What is whaling?
Spear phishing aimed at senior executives, directors or their assistants, or impersonating them. Because executives can approve large payments and reach sensitive information, successful whaling tends to cause larger losses.
Is business email compromise the same as spear phishing?
They overlap. BEC is fraud using a fake or hijacked business email account, usually to redirect a payment. Most BEC is delivered as spear phishing, but it often has no link or attachment — which is why call-back verification matters more than filters.
What should you do if you fall for a spear phishing email?
Report it internally at once. If a payment was made, call your bank immediately. Reset the password of any affected account, revoke sessions, check for new forwarding rules, and report the crime — in the UK to Report Fraud (or Police Scotland), in Australia through ReportCyber.
Turn phishing controls into tracked risks
In Risk Samurai, spear phishing and BEC risks sit in your register with owners, controls, indicators and review dates — so you can see whether call-back checks and MFA coverage are actually holding. AI drafts the first version of your register to get you started.
Get early access