Advanced Phishing Tactics: Spear Phishing and Business Email Compromise

When Phishing Gets Personal

Standard phishing casts a wide net. Advanced phishing is surgical — and far more dangerous.

Spear Phishing

Spear phishing targets a specific individual using information gathered from social media, LinkedIn, company websites, or prior data breaches. An attacker might know:

• Your name, job title, and employer
• The name of your manager or colleagues
• Projects you’re currently working on
• Recent purchases or subscriptions

Example: You receive an email appearing to be from your CEO: “Hi [Your Name], I need you to process an urgent wire transfer before our board meeting. Don’t mention this to anyone — it’s confidential.” This is a Business Email Compromise (BEC) attack.

Business Email Compromise (BEC)

BEC attacks cost businesses billions annually. Common scenarios:

• CEO Fraud: Criminals impersonate an executive and instruct finance staff to transfer funds.
• Vendor Impersonation: Attackers pose as a supplier and ask you to update payment details to their account.
• Legal Impersonation: Fake lawyers or auditors demand urgent, confidential action.

How to Protect Against Spear Phishing

• Verify any unusual financial or credential requests via a separate communication channel (phone call, in-person).
• Be cautious about what personal information you share publicly on LinkedIn and social media.
• Implement a “call-back” verification policy for wire transfers or sensitive changes at your workplace.
• Check the actual email address — not just the display name.

QR Code Phishing (Quishing)

A newer tactic involves embedding malicious URLs inside QR codes — in emails, flyers, or even fake parking tickets. Since QR codes are opaque, they bypass many email filters. Always be cautious scanning QR codes from unexpected sources, and check the URL before proceeding.