Phishing is sent to thousands of people at once and hopes a few bite. Spear phishing is written for one person, using details about them that are usually public. That is the whole difference, and it changes everything downstream: who gets hit, whether your filters catch it, and what stops it.
Spear phishing vs phishing matters because the defences are not interchangeable. A filter tuned to catch bulk phishing will wave through a well-written spear phishing email, and training built around spotting bad grammar will not help against a message that reads exactly like your finance director.
Phishing is a volume business. Spear phishing is a research job. Anything that defends against the first by looking for sloppiness will miss the second entirely.
What Is Phishing?
A fraudulent message sent at scale to trick people into giving up credentials, card details or money. The same email goes to thousands of addresses on the assumption that a small percentage will act on it. It is cheap to run, which is why it remains the most common attack UK businesses report.
The government’s Cyber Security Breaches Survey found phishing was the most prevalent type of breach or attack by far, experienced by 38% of businesses. Nothing else in the survey comes close.
Classic bulk phishing is recognisable once you know the pattern: a generic greeting, manufactured urgency, a link that does not match the sender’s domain, and often the small errors that come from writing at volume in a second language.
What Is Spear Phishing?
A targeted message written for one named person or a small group, built from details the attacker has researched. It will often impersonate someone the recipient already trusts: a colleague, an executive, a supplier mid-invoice. The aim is usually higher value than a stolen password.
The research is the point. A spear phishing email might reference a real project, a real supplier, or a meeting that genuinely happened, because all of that is findable on LinkedIn, in press releases and in your own published team pages.
That is also why it reads correctly. There is no bad grammar to spot, no generic greeting, and frequently no link at all, just a plausible request to change bank details or approve a payment.
Worried About Targeted Email Attacks?
Transputec deploys Mimecast email security end to end, covering anti-phishing, business email compromise and impersonation defence, alongside a 24/7 UK managed SOC with human analysts on every shift. Talk to our team about the security work behind your email.
Get a Strategic ConsultationSpear Phishing vs Phishing: The Key Differences
Five things separate them, and the last two are what decide how much damage gets done. The table below is the short version. If you only take one row away, take the detection row, because it explains why businesses that have never been caught by bulk phishing still lose money to the targeted kind.
| Phishing | Spear phishing | |
|---|---|---|
| Targeting | Thousands of addresses at once, no selection | One person or a small group, chosen deliberately |
| Personalisation | Generic. Dear Customer, Dear User | Real names, job titles, live projects and suppliers |
| Objective | Credentials, card details, malware at volume | Payment redirection, system access, confidential data |
| Detection | Often caught by filters and by trained staff | Reads as legitimate. Frequently no link or attachment to flag |
| Cost when it lands | One compromised account, usually contained | Often a direct financial loss, sometimes six figures |
Put simply, phishing is a numbers game and spear phishing is a research job. That is why spear phishing vs phishing is not a ranking of severity so much as a difference in kind, and why defending against one does not defend against the other.
Why Does Spear Phishing Get Past Email Filters?
Because there is often nothing for the filter to object to. This is the sharpest practical split in spear phishing vs phishing. Most email security scores a message on reputation, known-bad links, attachments and bulk-sending patterns. A spear phishing email frequently has none of those: it comes from a clean domain, carries no payload, and is sent once.
Impersonation is the harder problem. An attacker who registers a domain one character different from your supplier’s, or who has already compromised that supplier’s real mailbox, is sending technically legitimate mail. The content is the attack, and content is what filters are worst at judging.
This is why layered email security matters more than any single product. Transputec deploys Mimecast for anti-phishing, business email compromise and impersonation defence specifically because lookalike domains and compromised supplier accounts need rules that a standard spam filter does not apply.
Assume some will get through. The measure that matters then is how quickly somebody reports it, which is a culture and process question rather than a technology one.
How Do You Spot a Spear Phishing Email?
Not by looking for bad spelling. The reliable signals are about the request rather than the writing: an unusual payment instruction, a change of bank details, pressure to act before you can check, or a sender asking you to break a process you would normally follow. Those hold even when the email is perfect.
Check the reply-to address rather than the display name. Display names are trivially forged, and on a phone the real address is usually hidden behind them. A reply-to that differs from the sender is one of the few mechanical tells left.
Verify out of band, always. If an email asks for money to move or credentials to change, confirm it by a channel you already had: a known phone number, a chat message, walking to their desk. Never the contact details in the email itself.
Then report it even when you did not fall for it. The NCSC is clear that staff who report are a valuable early warning system, and the report is what tells your security team the campaign is happening at all.
Where Does Whaling Fit In?
A whaling attack is spear phishing aimed at the top of the organisation: the finance director, the CEO, whoever can authorise a payment without a second signature. Same technique, higher-value target, and usually more research behind it because the payoff justifies the effort.
The variant that costs most money is the one that impersonates the executive rather than targeting them. A message that appears to come from the CEO, sent to someone in finance, asking for an urgent transfer, bypasses every technical control because nothing about it is technically wrong.
The defence is procedural rather than technical. A payment approval process that cannot be overridden by urgency or seniority removes the entire attack, and it costs nothing to implement.
How Do You Defend Against Both?
Layered, because no single control covers the range. Filtering stops the bulk traffic, process stops the payment fraud, training changes what people do with what gets through, and monitoring catches the account that has already been compromised. Remove any one layer and the others are doing work they were not designed for.
Start with multi-factor authentication, because it limits the damage of a credential that has already been given away. Then fix the payment process, since that is where spear phishing converts into actual loss.
Train for the request, not the typo. Our post on security awareness training covers what changes behaviour, and phishing simulations measure whether it worked. Run them in that order.
Then plan for the one that lands. A tested phishing playbook decides who does what in the first hour, which is the window that determines whether a compromised mailbox becomes a compromised bank account.
Your Checklist
Work through these if you are not sure where you stand.
- Multi-factor authentication on every account, with no standing exceptions.
- A payment process that requires out-of-band verification for any change of bank details.
- An approval rule that seniority and urgency cannot override.
- Email security that inspects for impersonation and lookalike domains, not just spam.
- A report button that works, and a person who receives what it sends.
- Training that teaches the suspicious request rather than the suspicious spelling.
- A tested response plan for the hour after somebody clicks.
Conclusion
Spear phishing vs phishing comes down to volume against research. One is sent to everybody and caught by most defences. The other is written for one person, reads correctly, and often carries nothing a filter can object to. They need different answers.
The practical version: filters and training handle the bulk, process and verification handle the targeted, and a reporting culture handles what gets through either. Transputec runs that work through cyber security services, with Mimecast email security and a 24/7 UK SOC behind it. Talk to us about the security work behind your email.
FAQs
What Is the Difference Between Phishing and Spear Phishing?
Scale and research. Phishing goes to thousands of people with a generic message. Spear phishing is written for one named person using details the attacker has researched, usually impersonating someone they already trust. The targeted version is far harder to detect and tends to cost more.
Why Does Spear Phishing Bypass Email Filters?
Because there is often nothing technically wrong with it. It comes from a clean domain, carries no malicious link or attachment, and is sent once rather than in bulk. Filters score reputation, payloads and sending patterns, and a well-built spear phishing email presents none of those signals.
How Do You Spot a Spear Phishing Email?
Judge the request, not the writing. An unexpected payment instruction, a change of bank details, pressure to skip a normal check, or a sender asking you to break process. Check the reply-to address rather than the display name, and verify out of band using contact details you already had.
Is Whaling the Same as Spear Phishing?
Whaling is spear phishing aimed at senior people who can authorise payments, or at impersonating them to someone who can. The technique is identical. What changes is the value of the target and the amount of research behind the message.
Which Is More Dangerous for a Business?
In spear phishing vs phishing, the targeted kind does more damage, though plain phishing is far more common. Bulk phishing usually costs you one compromised account. A successful spear phishing or whaling attack more often ends in a redirected payment or access to systems, and the loss is direct.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
