Secordit home
Contact

What is spear phishing?

Spear phishing is a targeted form of phishing. The sender uses information about a person or organisation to make the message more persuasive, rather than sending a mass mail indiscriminately. The NCSC also describes whaling as a type of spear phishing aimed at a big target, such as a board member. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. The sender gathers details from a website, social media or a professional profile, sometimes called a digital footprint. 12
  2. The message is written to look as if it comes from a known contact, often using a webmail address or a lookalike domain. 21
  3. The request may ask you to open a link, share information, approve a payment, or sign in. 1

Real UK example

An NCSC advisory described spear-phishing campaigns against UK targets. The senders used research, fake expert profiles, and webmail addresses that impersonated known contacts. That is an illustration of the method. It is not a claim that every reader is a state-backed target. 2

Warning signs

  • An email looks personal, and mentions work, a recent event, or a colleague, but the request is unexpected. 12
  • The sender address is a public webmail account, or a lookalike of a domain you know. 21
  • The message asks a senior person, or someone who can authorise payments, to act without a second check. 1

What to do now

  1. Do not use the contact details in the message. Check the request through a phone number or channel you already trust. 1
  2. Turn on MFA or a passkey for email and other important accounts, and report suspicious messages to your IT lead if you have one. 1
  3. Limit how much useful personal or work detail is published on public profiles, where you can. 12

UK reporting and support

  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 356
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 4
  • If someone is in danger, call 999. 56

How to protect yourself

  • Help staff report suspicious messages, and make it harder for those messages to reach people, using the organisation's usual email controls. 1
  • Use strong sign-in, such as MFA or passkeys, on email and payment systems. 1
  • Be careful about how much useful detail is published about roles, travel or payment processes. 12

Frequently asked questions

How is spear phishing different from an ordinary phishing email?

The NCSC describes spear phishing as targeted. The sender uses information about a person or organisation to make the message more persuasive, rather than sending a mass mail indiscriminately. 1

What is whaling?

The NCSC describes whaling as a type of spear phishing aimed at a big target, such as a board member. 1

Does a personal-sounding email mean it is genuine?

No. Personal detail can be taken from a public profile and used to make a fake message more convincing. Check the request through a channel you already trust. 12

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Phishing attacks: defending your organisation | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, SEABORGIUM and TA453 spear-phishing campaigns | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  4. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  5. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  6. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).