Spear phishing examples: what a targeted fake email looks like
Quick answer
Spear phishing is a phishing message aimed at you in particular, so it can use your name or details about you. Treat any unexpected link or attachment as unsafe. Contact the company using a phone number or website you know is real, then report the message.
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
How it works
Regular phishing goes to thousands of people. Spear phishing is aimed at one person or a small group, so the message feels personal.
The FTC describes how phishing messages work: an email or text that looks like it's from a company you know or trust, like a bank, a credit card or utility company, or an online payment site. It tells a story to get you to click a link or open an attachment. The story might be suspicious log-in attempts, a problem with your account or payment details, a request to confirm personal or financial information, an invoice you don't recognize, or a coupon or government refund.
The goal is your passwords, account numbers or Social Security number. With those, scammers can get into your email, bank or other accounts, or sell your information to other scammers. A link or attachment can also install malware.
The FTC's own example email looks real at first glance, even with the company's logo. The signs it's fake: a generic greeting, a claim that your account is on hold because of a billing problem, and a link to update your payment details. The FTC says legitimate companies won't email or text a link to update your payment information.
Sources checked: consumer.ftc.gov
Last verified against the official page:
Red flags
- An unexpected email or text from a company that asks you to click a link or open an attachment
- A claim of suspicious log-in activity or a problem with your account or payment details
- A request to confirm personal or financial information
- A generic greeting, even if the logo looks right
- A link to update payment details
- An invoice or refund you weren't expecting
Example message
Hi [your name], we noticed a billing problem and your account is on hold. Please update your payment details here: [link]. Your invoice is attached.
What to do
- 1
Ask: do I have an account with them?
The FTC says to ask whether you have an account with the company or know the person. If not, it could be phishing: report the message, then delete it.
- 2
If you do have an account, verify separately
Contact the company using a phone number or website you know is real, not the information in the email. Attachments and links might install harmful malware.
- 3
If you gave out personal details
Go to IdentityTheft.gov for the steps that match what you shared, such as a Social Security, credit card or bank account number.
- 4
If you clicked a link or opened an attachment
Update your computer's security software, run a scan and remove anything it flags.
- 5
Add layers of protection
The FTC suggests security software with automatic updates, automatic updates on your phone, multi-factor authentication on your accounts, and backups of your data.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
A targeted message needs details: your name, your employer, the companies you use. Scammers get them from people-search sites, public listings and data breaches. Serus finds where your details are listed and removes them, and alerts you when your data shows up in a breach, so there's less for a scammer to build a convincing message from. For text messages, the FTC says to forward them to 7726 (SPAM).
Frequently asked
What's the difference between phishing and spear phishing?
Phishing goes out in bulk. Spear phishing is aimed at a specific person, so it can use their name or details about their life or work.
Should I click a link to check if the email is real?
No. Contact the company using a phone number or website you know is real, not the information in the email.
I clicked a link. What now?
The FTC says to update your computer's security software, run a scan and remove anything it finds. If you shared personal details, go to IdentityTheft.gov.
Where do I report a phishing email or text?
Forward emails to reportphishing@apwg.org and texts to 7726 (SPAM), and report to the FTC at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
