What Spear phishing means
Spear phishing uses real names, projects and vendors to look legitimate, so it is much harder to spot. Finance staff and executives are common targets. Verify unusual requests through a separate, known channel.
Why it matters for your website
Because these messages use real names, projects and details, they are much harder to spot than generic spam. A single successful attempt can lead to wire fraud, a stolen website login or leaked client files.
Example
A bookkeeper gets an email that appears to come from the owner, mentions a real vendor by name and urgently asks for an invoice to be paid to a new bank account.
Tips
- Confirm any payment or bank change request by phone using a known number.
- Look closely at the sender's actual email address, not just the display name.
- Limit how much detail about staff and vendors you post publicly.
Common mistakes
- Trusting a message because it mentions real people or real projects.
- Replying to the suspicious email itself to ask whether it is genuine.
Questions about Spear phishing
What is Spear phishing?
A targeted phishing attack crafted for a specific person or company using details about them.
How is spear phishing different from regular phishing?
Regular phishing sends the same message to many people. Spear phishing is tailored to a specific person or company using researched details to seem believable.
What should I do if I clicked a spear phishing link?
Disconnect if you entered anything, change the affected passwords from a safe device, turn on multi-factor authentication and tell your IT contact right away. If money was sent, contact your bank immediately.
