Spear phishing
Spear phishing is a targeted version of phishing aimed at one specific individual or organization rather than a broad crowd. Before writing, the attacker does homework and adds real details, a name, a job title, a recent purchase, a colleague's name, so the message reads as personal and believable. That careful tailoring makes it far more convincing than generic phishing.
How we check this: Written and reviewed by the Hunch team; recognition signs reflect how the FTC/FBI describe this scam. · Last reviewed: 2026-08
Check a suspicious message now
Example
An employee receives an email that appears to come from their own CEO, referencing a real project by name and asking them to quietly buy gift cards or approve a wire transfer 'before the end of the day.' The personal context makes the request seem routine.
How to recognize it
- A message that knows unusually specific things about you or your work
- An unexpected request from a 'boss' or colleague to move money or buy cards
- Urgency combined with a plea for secrecy or to skip normal procedure
- A reply-to address or domain that's a near-copy of the real one
How Hunch flags it
Hunch looks at signal categories such as a payment or credential ask arriving with pressure, a lookalike sender domain, and mismatches between the claimed identity and the actual address, rather than at the personal details themselves.
FAQ
How is spear phishing different from regular phishing?
Regular phishing is sent broadly and generically; spear phishing targets a specific person and uses researched personal details to appear legitimate.
Why is spear phishing so effective?
Because the message references real names, projects, or relationships, it bypasses the 'this doesn't apply to me' instinct and feels like normal business communication.
Can verifying through another channel help?
Yes. Confirming an unexpected money or data request by calling the person on a known number, not by replying, defeats most spear-phishing attempts.