Spear phishing

Spear phishing is a targeted form of phishing in which attackers research a specific person or organization and craft personalized messages that are much harder to recognize as fraudulent.

Generic phishing goes to thousands of people. Spear phishing uses details gathered from websites, LinkedIn, social media or previously stolen emails to reference real names, projects, suppliers and events. A message might appear to come from your accountant during tax season or from a known vendor about an overdue invoice.

Because the messages look legitimate and relevant, even careful employees can be fooled. Spear phishing is commonly used to steal Microsoft 365 credentials and launch business email compromise, where criminals redirect payments to their own bank accounts. Finance staff, executives and office managers in Alberta businesses are frequent targets.

Practical tip: be thoughtful about how much detail about staff roles and internal processes you publish online. Use email warnings that flag messages from outside your organization, enforce multi-factor authentication and require phone verification on a known number for any payment or banking change, no matter how genuine the email looks.