Spear phishing is a phishing attack aimed at one specific person or company, written after researching the target so the message reads like it came from a colleague, a supplier or a system they use every day. Where ordinary phishing casts a net across thousands of inboxes, spear phishing is the hand-tied fly: fewer messages, far higher accuracy. It is the pattern behind most of the expensive incidents — the invoice fraud that empties a bank account, the one credential that unlocks a whole network.
TL;DR
- Spear phishing is targeted phishing: researched, personalised, usually low-volume, and built to look like routine business email.
- It defeats filters because it carries no mass-mailing signals — often a clean domain, a real thread, no malicious attachment.
- Australians reported $166.8 million lost to payment redirection scams in 2025 (Scamwatch), and BEC fraud was 15% of Australian business cybercrime reports to ASD in 2024-25 — most of that is spear phishing by execution.
- The defence is verification habits plus regular simulation practice, not a better spam filter.
What is spear phishing?
Spear phishing is a phishing attack tailored to a specific target. The attacker learns who does what at your company — from LinkedIn, your website, breach data or a previous compromise — and writes a message that could only make sense to you: a quote for the job you just quoted, an invoice for the shipment you are waiting on, a reply in a thread you actually recognise.
The distinction is scope, not sophistication:
| Mass phishing | Spear phishing | |
|---|---|---|
| Target | Anyone, thousands of inboxes | A named person or role |
| Research | None — generic lure | Public info, breached data, or a stolen mailbox |
| Volume | Enormous | A handful of messages |
| Filters | Catch most of it | Often pass, because nothing looks mass-produced |
| Typical ask | Credentials on a clone page | Payment change, data transfer, or one credential |
Spear phishing delivered over email with a financial goal is what the industry calls business email compromise; the same targeting discipline also arrives by text and phone call. The names differ by channel; the craft is the same.
How a spear phishing attack actually unfolds
- Reconnaissance. The attacker builds a file on the target: who approves payments, which suppliers are used, when payroll runs, who is on leave. Much of it takes an afternoon on LinkedIn and your own website.
- Positioning. Either a lookalike domain is registered, or a real mailbox is taken over — a supplier's, or a colleague's, via a previous credential theft. Reply-chain hijacking lets the attack ride an existing, legitimate conversation.
- The approach. Often a harmless opener to establish contact, then the ask: new bank details, an urgent confidential payment, a document that needs your login.
- The execution. Urgency and secrecy close the gap before verification happens. The payment leaves, or the credential lands, and the attack is finished before a filter ever weighs in.
Why it slips past email security
Spam and phishing filters key on scale: bad infrastructure, bulk sending patterns, known-bad links. A spear phishing email has none of those. It comes from a real account or a freshly registered clean domain, contains no attachment, and links either nowhere or to a brand-new page no reputation list has seen. AI writing tools removed the last easy tell — the awkward phrasing. That is why the most dangerous message of the year is often a plain-text email in a thread you were already part of.
What it costs
- $56,571 — the average self-reported cost of cybercrime per report for Australian small business in 2024-25, up 14% on the prior year (ASD Annual Cyber Threat Report 2024-25).
- $166.8 million — reported losses to payment redirection scams in Australia in 2025, up 9.3% (Scamwatch).
- 15% — of business cybercrime reports to ASD in 2024-25 were BEC fraud with a financial loss; email compromise without loss was reported almost as often.
- USD 5.29 million — the average cost of breaches entering through voice and SMS social engineering in IBM's 2026 Cost of a Data Breach Report, with phishing again the most common initial attack vector.
Spear phishing is the mechanism behind a large share of those numbers: targeted, convincing, and pointed at whoever can move money or data.
How to spot a spear phishing email
Personalisation defeats pattern-matching, so the checks have to defeat personalisation:
- Verify the request, not the sender's familiarity. A real display name and a real thread prove nothing if a mailbox was stolen. The question is never 'does this look like Sarah' but 'was this request expected'.
- Treat any change of payment details as unverified. Bank detail changes are confirmed by phone, on a number already held — never on a number or address supplied in the message. This single rule defeats the most profitable spear phishing variant.
- Read the actual address. Lookalike domains still fail a three-second character-by-character look when you expand the sender.
- Watch the pressure combination. Urgency plus secrecy plus authority appearing together is the signature of the attack, whatever the pretext.
- Question context you cannot confirm. A reply in an old thread asking to continue 'here' instead of the usual channel is a hijack flag.
Training that works against targeted attacks
Because spear phishing defeats technical controls by design, the human layer carries the defence — and the human layer needs rehearsal, not a memo. The evidence-backed loop is:
- Short monthly training on the current tactics, including the invoice-fraud and mailbox-takeover plays aimed at finance and admin staff. Cyber Aware's security awareness training runs 120+ story-driven modules on a monthly auto-add cadence, so the content tracks the scam waves rather than last year's.
- Realistic simulations that mirror targeted lures. A 100+ template phishing simulation library — invoice fraud, spear-phishing-style personalisation, MFA prompts — gives staff safe reps, and anyone who clicks is auto-enrolled in the matching remediation course the same week. Teams that run the loop consistently see an average 80% reduction in clicked links by month eight.
- Per-person measurement. Human risk reporting ranks who keeps getting caught so the follow-up lands on the right two desks, not the whole company.
Not sure whether your weakest layer is process or tooling? A security gap assessment finds out in an afternoon. Comparing platforms before you commit? The 2026 comparison puts the main options side by side.
FAQ
What is spear phishing in simple terms? A scam message written for you specifically — using your name, your job, your suppliers — to trick you into paying money or handing over a credential. Ordinary phishing spams everyone; spear phishing studies you first.
How is spear phishing different from phishing? Scale and research. Phishing is a mass, generic lure; spear phishing is low-volume, personalised and much harder for both filters and people to dismiss. The damage rate per message is far higher.
Is business email compromise the same as spear phishing? BEC is the financial-fraud outcome that most spear phishing campaigns aim for — impersonating an executive or supplier to redirect a payment. The terms overlap because the technique is the same.
Can security software stop spear phishing? Not reliably. With a clean domain, no attachment and a real or well-cloned identity, there is little for a filter to detect. Verification process and trained staff are the control that holds.
Who in a company is most at risk? Whoever can move money or data on request: accounts payable, bookkeepers, HR, executive assistants — and new starters who have not yet learned the normal process.
One last thing
Spear phishing spends days earning your trust to steal minutes of your attention. The counter-measure that breaks it is equally small: one verification phone call on a number you already had. Train the reflex, rehearse it monthly, and the research the attacker invested works against them.