Spear phishing explained — targeted scams and AI risk

Note: This site may show light ads and occasional affiliate links. How that works.

Spear phishing is phishing with homework. Instead of a generic “Dear customer” email, the message uses your name, your job, or something you posted online. Ai can make the wording smoother and the fake voice or video more convincing. The levers stay the same: urgency, authority, and a request you did not go looking for.

That is why it catches people who already know what ordinary phishing looks like — the personal detail is the disguise.

What makes it different

It looks like someone you know — a boss, colleague, supplier, or bank you actually use
The details feel personal — a project name, a recent holiday, a real invoice number
It may arrive by email, text, phone, or even a fake voice or video clip

Warning signs

Sender address slightly off — extra letters, odd domains, reply-to that does not match
Urgency plus secrecy — “wire this today,” “do not tell finance yet”
Unexpected attachment or link, especially payment or login changes
Small changes in tone or format from someone who usually writes differently

At the moment of risk

Stop! Pause! Is it urgent? Do you know who it is from? Is it really from who it says it is? If a colleague or manager asks for money, codes, or password changes through email or chat — call or message them on a number or app you already use. Not the one in the message.

What helps day to day

Turn on mfa on email and banking — especially email, which resets everything else
Be careful what you post publicly — job title, travel plans, org charts help scammers dress up
In a small team, agree how payment changes get confirmed — always out of band
Forward odd messages for a second look — speed beats embarrassment

A self-check

If your “boss” emailed right now asking you to buy gift cards or approve a payment in the next hour — would you call back before acting, or would urgency decide? That honest answer tells you where to tighten the habit.