Spear Phishing and Whaling: The Tailored Attack
A mass campaign counts on a fraction of a percent of clicks. Spear phishing needs one. We explain where attackers get their knowledge of your company, and why a payment procedure protects you better than vigilance.
The biggest mistake in thinking about spear phishing is treating it as better phishing. It is a different attack. A mass campaign plays the odds. A targeted one goes after a specific person and a specific transfer. A filter catches the first through repetition. The second has nothing to repeat.
What is spear phishing?
Spear phishing targets a specific individual or a small group. Instead of a thousand identical messages, the attacker sends one, written after days or weeks of collecting information about the victim.
The result is that classic warning signs stop being useful. The message has no language errors. It references a project that is genuinely running. It comes from someone the victim really works with, at a moment when that makes sense. The whole mechanism comes down to context. In the wider picture it is one of the variants covered in our guide to types of phishing, but for businesses it is the most expensive one.
What it costs
Spear phishing rarely ends at a stolen password. Usually it ends at a payment. The FBI IC3 annual report for 2025 gives concrete numbers for BEC, meaning business email compromise.
What these numbers cover, and what they miss
IC3 collects complaints from victims in the United States, and only the ones somebody bothered to file. That $3.046 billion is a floor, not a total. For a company outside the US the direction matters more than the amount, and the direction is clear: the value of a single attack is rising, not the number of attacks. The mechanism does not depend on jurisdiction, only on what your payment procedure looks like.
Worth pairing that with another figure from the same report. Phishing and spoofing complaints stayed practically flat year on year, 191,561 against 193,407. Losses in the same category rose from $70 million to $215.8 million, up 208%. Attackers are no longer optimising for the number of victims, only for the value of each one.
How it differs from mass phishing
Both techniques share a goal but have completely different economics and risk profiles:
| Dimension | Mass phishing | Spear phishing |
|---|---|---|
| Scale | Thousands of recipients in one campaign | One person or a small group |
| Preparation | Minutes, off an existing template | Days to weeks of reconnaissance |
| Content | Generic, interchangeable between targets | References the victim's real business |
| Detection | Filters catch the campaign through repetition | Nothing repeats, so filters have nothing to compare |
| Stakes | A stolen password | A payment approved by someone with authority |
What changed in 2026
Until recently, pretexting sat inside the phishing numbers. The Verizon DBIR 2026 broke it out for the first time as its own initial access vector, driven by a run of high-profile intrusions where the attacker opened with a conversation or a well-built message rather than a malicious attachment. The same pattern ended in ransomware further down the chain.
There is one practical consequence for defenders. If four in ten social engineering breaches arrive by a channel other than email, the mail filter by definition cannot see a large part of the problem. The call that backs up an earlier message has stopped being an anecdote from a conference slide and become a measured part of the scenario.
Whaling: when the board is the target
Whaling is spear phishing aimed at the most senior roles. CEO, CFO, board member. The name refers to the size of the prize, because that account carries access to strategic information and authority nobody below has.
Leadership is more exposed than the rest of the organisation, for reasons that are hard to remove. Their details are public in press releases and company registries. They work under time pressure, often outside standard procedure. And subordinates rarely question an instruction from the CEO. That last point matters most, because the attack does not need to compromise an account at all. It only needs the message to look right.
A layer has been added that did not exist three years ago. The AI-flagged losses cited above are an undercount by design, because the label only lands on a complaint when the victim recognised the element and described it. In practice it usually means a phone call backing up an earlier message, in a voice that sounds familiar. We cover the vector itself under vishing, and its executive-facing version in a campaign against C-level staff.
How a targeted attack unfolds
Target reconnaissance
The attacker builds a profile: role, responsibilities, managers, current projects, writing style, travel plans. Almost all of it is public.
Building the pretext
A scenario gets built around the victim's reality. A reference to a live transaction, an urgent invoice approval, a message supposedly sent from an airport before takeoff.
Contact and compromise
The message reaches the target, usually from a lookalike address. More and more often a call or text follows, to lend the request credibility.
Achieving the objective
At the end there is a payment to the criminal's account, exfiltrated documents, or lasting mailbox access used later for further attacks inside the company.
What attackers already know about your company
Reconnaissance rarely requires a breach. What the organisation publishes itself is usually enough:
- Professional networks: org structure, roles, personnel changes
- Company website: email format, names, departmental contacts
- Registries and filings: board members, ownership links, financial position
- Social media: travel, conferences, photos of badges and screens
- Previous breaches: passwords and addresses leaked from other services
- Job postings: technologies, internal systems, sometimes the security tooling by name
What national statistics will not show you
Before carrying the IC3 conclusions straight over to a local market, it is worth checking what national statistics actually measure. CERT Polska registered 260,783 unique incidents in 2025, up 152% year on year. Computer fraud made up 97% of them, or 253,238 events, and phishing alone accounted for 78,391 — 30% of everything registered.
Those numbers describe consumer-facing fraud above all. The most frequently abused brands were the classifieds platform OLX (28,500 cases) and the marketplace Allegro (22,500), meaning fake-sale and surcharge scenarios rather than an invoice with a corrected account number. A campaign impersonating a marketplace reaches tens of thousands of people and leaves a clear trace in the statistics. One message to the CFO of one company leaves no such trace.
The practical conclusion is that for this particular risk most companies have no national benchmark and have to work from US data, keeping its limits in mind. Operationally it changes nothing. A payment procedure that requires confirmation on a return channel works the same way regardless of which statistic the incident eventually lands in.
Warning signs
Since a targeted attack is linguistically polished, attention has to move from the form to the nature of the request:
- The request bypasses standard procedure, for example "don't involve finance, let's handle this directly"
- Pressure for confidentiality set alongside pressure of time
- A changed account number in an ongoing matter, even if the thread looks familiar
- Replies route to a different address than the message appeared to come from
- An instruction from someone who does not normally handle such things
- A difference in the sender domain: a swapped letter, another suffix, an added hyphen
- Looking for language errors. A targeted attack has none, and their absence tends to get read as proof of authenticity.
- Assuming the filter would have caught it. A message with no attachment and no link has nothing for a filter to reject it on.
- Replying to the message to confirm it. If the address is spoofed or the mailbox is compromised, the confirmation comes from the attacker.
- Relying on MFA for a payment. The second factor protects a login, not a financial decision the victim makes deliberately and on their own.
KEY TAKEAWAYS
- 1One well-prepared message is more dangerous than a thousand generic ones, because it evades filters built on repetition
- 2Four in ten social engineering breaches arrive by a channel other than email, so a mail filter does not close the subject
- 3Reconnaissance uses open sources, so limit what you publish about company structure
- 4The board needs its own training programme, not the same one as everyone else
- 5Verify on a return channel: call a number from your own records, do not reply to the message
- 6The payment procedure has to work even when the request looks authentic
How to defend
Defence rests on processes that urgency and authority cannot bypass:
- Require two-person approval for payments above a defined threshold
- Confirm every account number change by phone, using a number from your own records rather than the message, and remember that the call itself can be the attack
- Set DMARC to reject alongside SPF and DKIM, to cut off spoofing of your own domain
- Monitor lookalike domains and get them taken down before anyone uses them
- Cover executives and their assistants with spear phishing simulations built on real reconnaissance instead of a stock template
- Deploy hardware keys for accounts with elevated privileges
- Tag external messages with a visible warning in the mail client
- Limit organisational detail published on your website and in job listings
- Let leadership raise doubts without worrying about looking naive
- Benchmark your procedures against the Social Engineering Report 2026
The first hour after the payment
Once the payment has gone out, the order of your actions decides whether the money can still be stopped. The sequence below assumes you have confirmation: the account number does not match the contract, or the supplier says they never sent the request. Step one happens before you establish how exactly this occurred — there is time to work that out after the funds are frozen.
- Minutes 0–15Payment initiator + financeCall the bank before you establish anything
Ask them to freeze the payment and attempt a recall. Do not wait for the internal post-mortem. As long as the funds have not been withdrawn from the receiving account a recall can work, and the odds fall with every hour. Have the date, the amount and the beneficiary account number ready, and say plainly that the transfer was the result of fraud — that is a different track from an ordinary dispute.
- Minutes 15–30IT / securityPreserve the message, do not delete the thread
Keep the message together with its full headers. They are what settles whether somebody spoofed the sender or a mailbox on either side was compromised, and the difference is fundamental: in the second case the matter does not end with one payment. Check the mailbox for forwarding and auto-move rules and review the sign-in history. A rule that hides the supplier's replies is a known part of this scenario and is sometimes the only sign that the access is still live.
- Minutes 30–45Finance + leadershipCheck whether this is the only payment
Review the other payment requests sent from that mailbox and every account number change reported by suppliers over recent weeks. If the mailbox really was compromised, it is rarely a single transaction. Hold pending payments until they have been confirmed on a return channel, and tell the finance team not to accept account number changes on the strength of a message alone until further notice.
- Minutes 45–60Compliance ownerStart the reporting clocks
File a criminal report with the police; the case number will be useful in further correspondence with the banks. Report the incident to your national CERT. If personal data was breached alongside it, a separate 72-hour clock starts for the supervisory authority, and regulated entities may have an early-warning deadline on top of that. From this point keep a simple log: time, who did what.
Frequently asked questions
What kind of attack technique is spear phishing?
It is a social engineering attack, not a technical one. It exploits the recipient's trust and haste rather than a software flaw. The message usually clears the filters without trouble, because technically there is nothing malicious in it: no attachment carrying code, sometimes not even a link. All the attacker's work goes into the wording and the context.
What is spear phishing called in other terms?
The closest plain-language equivalent is a targeted phishing attack, and whaling is described as an attack aimed at senior leadership. In practice the industry sticks to the English terms, so it is worth listing both forms in your security policy, so staff recognise the same thing in training and in a message from the security team.
Does MFA protect against spear phishing?
It limits the damage of a stolen password, but it does not stop an attack aimed at a payment. If the victim approves the transfer themselves, the second factor has nothing to block. For account takeover, SMS codes and push prompts can be bypassed; hardware keys on the FIDO2 standard are the first thing that holds. You can see it clearly in campaigns abusing OAuth Device Code, where the victim completes MFA on genuine Microsoft servers.
What should you do once the payment has gone out?
The first hour is what counts, and the order matters: the bank first, working out how it happened second. The full sequence is laid out above, in the section on the first hour after the payment. One point worth repeating: do not delete the message or the thread, because the mail headers are evidence and they show whether the mailbox was compromised or somebody merely spoofed the sender.
How does spear phishing differ from a BEC attack?
Spear phishing describes the method, BEC describes the objective. Spear phishing is a targeted message built for a specific person; BEC is the scenario where the outcome is money or data leaving the company through corporate email. Most BEC attacks start with spear phishing, but not every spear phishing attempt ends in a payment — sometimes the objective is lasting mailbox access, used only later. In the FBI IC3 statistics these are two separate categories, so figures from one should not be added to the other.
Conclusion
Spear phishing exploits something you cannot switch off: trust in familiar names, and willingness to move fast when a manager asks. A defence based on spotting fake messages will eventually fail, because these messages are good. What works is a procedure that demands confirmation regardless of how convincing the request sounds.
If your procedure only works when you spot the fraud, it is not a procedure. It is a lottery.
Sources
- 1.2025 Internet Crime ReportFBI IC3 · 2026 · accessed 2026-08-08Complaints from US victims only. BEC and phishing/spoofing are counted as separate categories.
- 2.2026 Data Breach Investigations ReportVerizon · 2026-05 · accessed 2026-08-08Over 31,000 incidents and 22,000 confirmed breaches across 145 countries. Pretexting broken out as its own initial access vector.
- 3.Raport roczny z działalności CERT Polska w 2025 rokuCERT Polska / NASK · 2026-04 · accessed 2026-08-08658,320 reports, 260,783 unique incidents, 78,391 phishing events.
Test the board before someone else does
We build spear phishing simulations from real reconnaissance of your organisation, the same way an attacker would. No stock templates, and a report showing exactly where the procedure gave way.