Phishing vs spear phishing: what's the difference?

Both are attempts to get you to hand over a credential, a payment or access. The difference is how many people received the same message — and that single variable changes almost everything else about the attack.

The comparison

Why bulk phishing looks the way it does

When a list costs almost nothing, the campaign does not need to convince most people. It needs to convince a fraction of a percent, and it needs to do so at volume.

That economics produces the phishing everyone recognises: a generic greeting, a universally applicable pretext (a delivery, a password reset, a bank alert), and no detail that could contradict a particular recipient's circumstances. It is vague on purpose — specificity would make it wrong for most of the list.

The APWG recorded over a million phishing attacks in a single quarter in 2025. That number only makes sense at this end of the spectrum.

Why spear phishing defeats the checklist

The standard advice — check the sender, look for urgency, check the link, watch for errors — assumes the message contains something wrong. In a well-built spear phishing message, the details are right.

From: Daniel Okafor <d.okafor@[your-actual-supplier].com> Subject: RE: Q3 renewal — updated remittance

Hi — following up from Tuesday's call. Finance has moved us to a new account ahead of the renewal, updated details attached. Can you get this over before Friday's cut-off?

The supplier is real. The renewal is real. Tuesday's call happened. The sender's address may be genuine, because their mailbox was compromised first.

The named variants

Whaling — spear phishing aimed at executives. The pretext involves something only a senior person could authorise: an urgent acquisition payment, a confidential request, a legal matter. Executives are chosen because they have authority, are often travelling, and their teams are trained to act on their instructions without friction.

Business email compromise (BEC) — the payment-focused version, and one of the most financially damaging categories in fraud reporting generally. It is usually the invoice-and-changed-bank-details pattern, run from either a compromised or a convincingly similar mailbox. The APWG recorded wire transfer BEC attacks rising 33% quarter on quarter in early 2025.

Clone phishing — a real message you already received, resent with the link or attachment swapped. Because the original was legitimate, the copy inherits its credibility.

Where the research comes from

Very little of it is stolen. Most is published, or for sale:

• Professional profiles: job title, reporting line, tenure, colleagues
• Company sites: staff lists, supplier names, press releases
• Social media: travel, absences, relationships, interests
• Conference programmes and industry press
• Data brokers: address history, household, purchases

This is the concrete link between privacy and security. Every published detail lowers the cost of writing a message you would believe.

What actually defends against each

Against bulk phishing, the ordinary defences work well: spam filtering, the four checks, a password manager that will not autofill on the wrong domain, and passkeys.

Against spear phishing, only two things reliably work.

1. Verify high-stakes requests out of band, every time, regardless of how convincing they are. Not a reply to the email — a phone call to a number from your own records. The rule has to be unconditional, because a rule you apply only when suspicious is a rule that fails exactly when it matters.
2. Make the category of request the trigger, not the message. Any change of bank details, any unusual payment, any credential request, any unusual confidentiality — verify by policy, not by instinct.

Reducing your public footprint helps too — not because it makes targeting impossible, but because it makes it expensive, and attacker effort is finite.