Spear Phishing and BEC: The Email That Knows Your Name

The 30-second explanation

Instead of a mass email to thousands, the attacker writes to you, by name, about something you are actually working on. That is why it is so convincing.

How it works

1. 1

   1. Research

   Names, roles and suppliers are gathered.

2. 2

   2. Impersonate

   A convincing sender or lookalike domain is used.

3. 3

   3. Request

   A payment change or urgent favour is asked for.

4. 4

   4. Loss

   Money or data goes to the attacker.

The attacker learns who you work with from public information. They then send a message that fits an ongoing situation: an invoice with changed bank details, an urgent request from a senior colleague, a shared document. There may be no link or attachment at all. The only 'malicious' thing is the request, which is why technical filters miss it and process checks, like confirming payment changes by phone, are the best defence.

Real-world example

How to spot it

• Changed payment details

  Any new bank account should trigger a separate check.

• Slightly different sender address

  A lookalike domain that reads correctly at a glance.

• Urgency plus secrecy

  'Do this now and do not tell anyone.'

• Reply-to that differs

  Replies going to a different address than the sender.

What to do

1. 1Confirm any change of payment details by calling a number you already have on file.
2. 2Require a second approval for large or unusual payments.
3. 3Report suspicious messages, even ones you did not act on, so colleagues can be warned.