Most phishing is a wide net — the same generic email blasted to millions. Spear phishing is the opposite: a single, carefully crafted message aimed at you, using real details about your life or job to slip past your guard. That precision is exactly what makes it dangerous. Our GetMyPassword team explains what spear phishing is and how to defend against it.
What spear phishing is
Spear phishing is a targeted form of phishing. Instead of a mass email, the attacker researches a specific person — their name, employer, colleagues, recent purchases, or interests, often gathered from social media and data leaks — and writes a message that feels personal and legitimate. It might appear to come from your boss, a coworker, your bank, or a vendor you use, and reference real context. The goal is the same as any phishing: get you to click a malicious link, open a harmful attachment, hand over a password, or approve a payment. The tailoring just makes it far more convincing.
How to recognize it
- A familiar sender with an off detail — a slightly wrong address or unusual tone.
- Personal context used to build trust, then an urgent or unusual request.
- Pressure to act fast or quietly, bypassing normal checks.
- A request to change payment details, share a password, or open an attachment.
- A link whose real destination does not match the text when you inspect it.
Why it works so well
Generic phishing trips alarms because it is impersonal and clumsy. Spear phishing removes those tells: it uses your real name, real relationships, and real circumstances, so the message fits naturally into your day. When an email seems to come from your manager about a project you are actually working on, skepticism drops. Attackers also exploit authority and urgency — a request “from the CEO” marked time-sensitive discourages you from verifying. The defense is to treat unusual requests as unusual no matter who they appear to come from, and to confirm through a separate channel.
A message that knows your name and your project has done its homework, not earned your trust. Verify unusual requests through a channel you choose, not the one the email hands you.
How to protect yourself
Slow down on any message that asks you to pay, log in, or share something sensitive, and verify it by contacting the person or company through a known number or address — never the contact details in the message. Limit what you share publicly, since that is the raw material for tailoring. Use two-factor authentication everywhere, so a stolen password is not enough, and give every account a unique password from our password generator, so one captured credential cannot unlock the rest.
Frequently asked questions
What is the difference between phishing and spear phishing?
Phishing is a generic message sent to many people at once. Spear phishing is targeted at a specific person, using real personal or work details to appear legitimate, which makes it far more convincing and harder to spot.
How can I tell if an email is spear phishing?
Watch for a familiar-looking sender with a small off detail, personal context followed by an urgent or unusual request, pressure to act fast or quietly, and links whose real destination does not match. Verify through a separate, known channel.
How do I protect myself from spear phishing?
Verify unusual requests through a known contact, not the details in the message; limit what you share publicly; turn on two-factor authentication; and use a unique password for every account so one stolen credential cannot open others.