Spear phishing

Spear phishing is a targeted phishing attack written for one person or company, using real details to make the message seem genuine.

Spear phishing: Spear phishing is phishing aimed at a specific person or organisation rather than thousands at random. The attacker studies the target and writes a message with real names, projects or purchases, so it looks genuine and the recipient is more likely to open a file or send money.

A common Indian case is the fake boss message: an email or WhatsApp saying it comes from the owner or director, asking an accounts person to pay an urgent bill to a new account. Another version copies a vendor's invoice with a changed bank account. The details are right because they were taken from a leak or from public pages.

Defend with process, not suspicion alone. Confirm any change in bank details or any urgent payment by calling the person on a known number. Require two people to approve large payments. Watch sender addresses closely, since they may differ by a letter, and be careful with attachments you were not expecting. A short call can stop a loss of lakhs, so make verification a habit, not an insult.

Tips

• Confirm any new bank account or urgent payment request by calling a known number.
• Check the sender's exact address and the reply-to line on unexpected emails.
• In an office, ask for a second person's approval on large payments.

Related terms