Spear phishing: protect accounts and payments

What is spear-phishing?

Spear-phishing is a targeted message, phone call or request that impersonates a trusted person. Its purpose may be account takeover, a payment, access to data or the opening of a malicious file. Defence requires technical email controls, MFA, a clear procedure for confirming payments and rapid reporting of suspicious messages. Spear-phishing is more dangerous than mass spam because it uses names, roles, business relationships and the urgency of real decisions.

How does spear-phishing work in a company?

The attacker collects context from public sources, correspondence or data leaks and then creates a message tailored to an employee’s role. Time pressure and authority are used to prompt a rapid decision.

Why are procedures as important as the email filter?

A filter reduces the number of malicious messages but will not stop every attempt. Confirmation through a second channel, MFA and rapid reporting limit the consequences of a click.

Which terms should the company know?

Distinguishing impersonation, credential phishing, business email compromise and MFA fatigue helps teams choose the right verification, identity and mail controls for each attack route.

• Spear-phishing: targeted phishing aimed at a particular person or role in the company.
• MFA, or multi-factor authentication, requires different types of identity evidence at sign-in.
• BEC: business email compromise that impersonates management, a supplier or a customer.
• Domain spoofing: impersonating a sender’s domain. This differs from sending a message through a genuine mailbox that has been compromised.

How spear-phishing differs from regular phishing

Phishing usually works en masse. Spear-phishing is targeted: the message refers to real people, projects, providers, invoices or the company's communication style. Therefore, the user needs simple verification rules and the organisation needs technical safeguards that will limit the effects of errors.

Who is most at risk

The attacker selects roles that have access to money, data, decisions or accounts. Protection should therefore start with a map of processes and people, and not with one general instruction for everyone. Attackers use information from LinkedIn, company websites, KRS, social media, job offers and previous correspondence.

• Finance: false invoices, change of account number, request for an urgent transfer or impersonation of management.
• HR: candidate documents, employee data, links to forms and attachments with malware.
• IT and helpdesk: password reset, access request, false report and attempt to take over the administrator account.
• Sales: inquiries with links, files from alleged customers and impersonating a contractor.
• Management: use of authority, time pressure and public information about the company.

What attack techniques do cybercriminals use?

The most effective campaigns combine technical and social engineering techniques. The message may look like a response to a real issue, lead to a fake login, ask for the MFA code, contain a malicious file or redirect the conversation to a private channel.

Warning signals for the user

The employee does not have to analyse mail headers like an administrator. However, they should know several signals that stop the process and trigger confirmation via the second channel. A cloned social-media login page or bank sign-in that captures a username, password or MFA code is a particularly strong warning signal.

• Time pressure, confidentiality, a request to bypass a procedure or contact outside the standard channel.
• A change to bank details, supplier details, shipping address, signature link or sign-in method.
• A request for a password or MFA code, an access reset, or approval of a prompt without prior context.
• A domain similar to the real one, an unusual footer, a different language style or a broken correspondence history.
• An attachment or link sent for a case that did not previously require file downloads.

A checklist for protecting your company against spear-phishing

Protection against spear phishing requires several complementary safeguards. The email filter reduces attacks, but the company still needs MFA, verification procedures, monitoring and exercises.

• Enable MFA for mail, VPN, Microsoft 365, administrators, and payment approvers.
• SPF identifies authorised sending sources, DKIM signs messages, and DMARC checks domain alignment and specifies how failed messages should be handled. They do not eliminate lookalike domains or messages from compromised, correctly authenticated mailboxes.
• Confirm bank-detail changes, payments and access resets through a previously verified contact, not a number or link in the suspicious message.
• Establish a channel for reporting suspicious messages and name a decision owner for each report.
• Monitor unusual logins, mail redirection rules, new app consents, and mass mailings.
• Provide short training for high-risk roles, rather than a single generic training module for everyone.

Threat of attacks in cyberspace – how to ensure information security?

Information security requires layers of policies, technology, training, monitoring and response. Spear-phishing should be treated as an incident scenario that affects email, identity, data, payments, permissions and customer communications.

• Combine email protection with MFA, EDR, backup, login monitoring and incident procedures.
• Introduce rules for confirming financial decisions, access resets and changes to supplier details.
• Maintain a register of reports and lessons learned from phishing simulations.
• Regularly check that high-risk accounts have the correct permissions and active MFA.

Daily habits against phishing

Daily security checks should be simple, consistent and supported by procedures. The employee should know when to stop the process and how to report a suspicion without fear of blame.

• Do not provide your password, MFA code or payment details after clicking on the link in the message.
• Confirm bank-detail changes, payments and access resets through a previously verified contact, not a number or link in the suspicious message.
• Check the sender's domain, correspondence history and unusual attachments.
• Report suspicious messages to IT, even if you are not sure whether it is an attack.
• Open familiar applications through a saved address or bookmark when a message unexpectedly asks you to sign in.

What to do if you suspect spear-phishing

Fast response reduces the impact of account takeover or payment fraud. The procedure should be known to users and the helpdesk before the incident, and not created during the crisis.

• Report suspicion promptly through the agreed channel. Preserve the original message for IT; do not open attachments or circulate it further.
• Report any disclosed password. Change it from a trusted device; IT should revoke affected sessions and review MFA, app consents and account activity.
• Stop the suspected payment. If funds were sent, contact the bank immediately through an official channel and report the fraud; recovery is not guaranteed.
• Check inbox rules, redirections, delegations, sent messages and app consents.
• Determine whether similar messages have been sent to other people and prepare a warning message.

Test scenarios for high-risk roles

A spear-phishing protection programme is more credible when exercises reflect real company processes. Finance, HR, helpdesk, management and sales should receive different scenarios. This tests decisions and procedures rather than only the ability to spot spelling mistakes. Use an approved scope, without collecting real passwords or delivering active malware. Assess reporting and response processes without blaming employees.

• Finance: supplier bank-account change, urgent transfer, new counterparty and pressure for confidentiality.
• HR: CV file, form link, request for employee data and an attachment containing a macro.
• Helpdesk: password reset, app consent, MFA request and impersonation of a remote employee.
• Management: fake strategic correspondence, a voice deepfake or a hijacked customer thread.
• Sales: request for proposal with a link, malicious document and an attempt to move the conversation outside the company channel.

How Virtline helps reduce spear-phishing in practice

We combine a technical review with an awareness programme. We check mail, domains, MFA, Microsoft 365, logs, payment procedures and roles exposed to attack. The result becomes a list of priorities, implementation actions and user materials.

Related guides and services

Spear-phishing is worth analysing together with passwords, MFA, email protection and user behaviour.

How to turn this into an action plan

Urgent MFA, email and payment-verification gaps need prompt action. Assign owners and establish essential controls first. Reviews after 30/60/90 days measure progress rather than postponing protection.

• 30-day review: account and process coverage, configurations and urgent exposure remediation.
• 60-day review: operation of MFA, domain protection, change verification and monitoring.
• 90-day review: exercise results, reporting time and closure of process recommendations.
• The responsibility matrix names the owner, deadline, completion evidence and approver for every action.
• The acceptance pack combines exports, procedures, exercise results and the decision log for IT and management.

Contact

Start with the roles most exposed to account takeover, supplier impersonation and payment fraud. Virtline will help define the scope, evidence to collect and the first controls to improve.

Sources and further reading