One of the most common ways that you can discern if an email is a phish is by checking the sender. If it is someone that you don’t know, or it is about something you did not expect, you don’t click on the email. Spear phishing is a way that attackers can get around this detection. A spear phish is not just a spam email sent out to as many people as possible to elicit clicks; they are planned, researched, and targeted. A true spear phish is when the hacker sends an email that appears to be from someone else, with the same email address; in fact, if a person replies to the spear phished email, the reply will go back to the person who was being impersonated.

A spear phish relies on familiarity. Through your online presence, the attacker knows your name and a few other details about you. Therefore, spear phishes will be personalized, and consequently more convincing. One of the most common methods of spear phishing is the spoofing of an email address. Skilled attackers can mask their sending with the email of someone you know, for example, a superior in the company. If that superior was to email you, you would probably do what they told you, even if the request was unusual. Another method of spear phishing is using the information you put online. For example, if you posted on Facebook that you bought a camera from Amazon, the spear phisher could pose as Amazon telling you that your credit card information needed to be confirmed before the camera was sent. This personalized, specific email is much more convincing than a regular phish, and therefore you need to be more vigilant in order to catch them. Here are some tips to catching spear phishes.

1. If there is an email from someone you know asking you to click a link, enter personal information, download a file, or do anything out of the ordinary, call or ask that person if they sent that email. If they say no, delete the email because it is a spear phish.
2. Do not let emotion get the better of you. Just because the email uses your name or references something you have done does not mean it is legitimate. Detach yourself from emotion before making a decision as to whether or not the email is legitimate.
3. Use all of the other phishing detection suggestions mentioned in previous articles. Although a spear phish is less likely to have obvious flaws, it is still a good idea to check.

Hopefully this article made you more cautious about the threat of spear phishing.

Author

This article was written by Afshan Chandani, Intern with Secure Guard Consulting, LLC, a cybersecurity / IT audit and consulting company.