Spear phishing: the characteristics that give a targeted scam away
Quick answer
Spear phishing is a phishing message written for you in particular, using details like your name, employer or a recent purchase. The tells are an unexpected request, pressure to act, a sender or link that doesn't quite match, and a push to skip your normal process. Verify through a number or site you already know.
- Comes by
- Email, Text, Social media
- First reported
- Latest official alert
- (CISA)
- Last updated
How it works
Ordinary phishing goes to millions of people with a generic greeting. Spear phishing is aimed at one person or a small group, and the sender uses details they found about you to make it believable: your name, your job, a boss or colleague, a company you use.
The message usually asks for one of four things: a login, a payment, a gift card purchase or a file opened. It may look like it comes from someone you know, from a vendor, or from your bank.
CISA's 2021 advisory on a spear phishing campaign describes emails sent from a compromised account at a legitimate email marketing company that appeared to come from a US government organization, which shows how real the sender can look. CISA's phishing guidance lists the common signs: a sender address that imitates a real business, a generic or odd greeting, links that don't match the text when you hover, misspellings, unexpected attachments, and pressure to act now.
Red flags
- It uses your name, role or a real detail, but the request is unusual
- A sender address that is close to a real one but not the same
- A link whose real address doesn't match the text when you hover over it
- An unexpected attachment or a request to sign in to read it
- Pressure to act right now or to keep it quiet
- A request to change payment details or buy gift cards
Example message
Hi [first name], I'm in a meeting and can't talk. Can you handle a quick task for me? I need you to buy gift cards for a client and send me the codes. I'll pay you back today.
What to do
- 1
Don't click, reply or call back
Don't click, open attachments or reply. Confirm the request with the sender using a phone number or email you already have, not one in the message.
- 2
If you clicked or typed in details, act on those accounts
Change the password for any account you signed in to, turn on two-step verification, and tell your IT team if it involves a work account.
- 3
If you paid or shared card details, call your card issuer
Use the number on the back of your card, not one from the message. Say it was fraud and ask them to block the card and reverse the charge.
- 4
Delete it and report it
Report the message at the official channels below, then delete it. Reports help investigators spot patterns.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Spear phishers build their message from details they can find on you. Scammers often pick targets using names, phone numbers and emails pulled from people-search sites and old breaches. Serus finds the data brokers that list you and removes you from them, and it alerts you when your email shows up in a breach, so fewer scammers can reach you. Our guide to what to do after a data breach covers the steps if your details leaked.
Official alerts
Frequently asked
What is the difference between phishing and spear phishing?
Phishing is sent in bulk with generic wording. Spear phishing is written for a specific person or group using details about them.
What is whaling?
Whaling is spear phishing aimed at senior people such as executives, usually asking for payments or sensitive files.
Can a spear phishing email come from a real account?
Yes. CISA has described campaigns that used a compromised account at a legitimate email provider, so a real-looking sender isn't proof.
What should I do if I clicked?
Change the password for that account, turn on two-step verification and report it to your IT team or the FTC.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
