Skip to content
Cyber Unboxed
Phishing

Spear Phishing and BEC: The Email That Knows Your Name

Spear phishing and business email compromise (BEC) skip the generic tricks. They use real names, real projects and real timing.

3 min readIntermediate Aug 7, 2026

Explain Like I'm Not a Hacker

It's a con artist who has read your diary. They know your boss's name and your current project, so the story sounds right from the first line.

The 30-second explanation

Spear phishing skips the mass email blast entirely. The attacker writes to you, by name, about a project you are actually working on right now. That specificity is exactly what makes it convincing.

How it works

  1. 1

    1. Research

    The attacker gathers names, roles, suppliers and live projects from public sources and social media.

  2. 2

    2. Impersonate

    A convincing sender address or a look-alike domain is set up, or a real mailbox is quietly taken over.

  3. 3

    3. Request

    A payment change, an urgent favour, or a document is asked for, framed to match something already underway.

  4. 4

    4. Loss

    Without an independent check, money or data goes straight to the attacker.

The attacker starts by learning who you work with, most of it sitting in plain public view: a company directory, a LinkedIn post, an out-of-office reply. They then send a message that fits something already in motion: an invoice with changed bank details, an urgent ask from someone senior, a document you were expecting anyway. Often there's no link and no attachment at all. The request itself is the only thing that's malicious, and that's precisely what technical filters are bad at catching. A phone call to a number you already had on file, confirming the change before anyone pays, stops most of these cold.

Real-world example

A finance employee receives an email that looks like it's from a regular supplier, saying the supplier's bank details have changed. The message references the right invoice number and the right amount. Without a separate phone call to confirm it, the next payment goes to an account the attacker controls instead.

How to spot it

  • Changed payment details

    Any new bank account on an existing supplier or contact should trigger a separate check, every time.

  • A sender address that's slightly off

    A look-alike domain that reads correctly at a glance but isn't quite right.

  • Urgency paired with secrecy

    'Do this now and don't mention it to anyone else' is a pressure tactic, not a normal request.

  • A reply-to address that differs

    Replies routed to an address that doesn't match the one the message came from.

What to do

  1. 1Confirm any change to payment details by calling a number you already have on file, not one in the email.
  2. 2Require a second approval for large or unusual payments, no exceptions.
  3. 3Report suspicious messages even when nobody acted on them, so colleagues get warned before they see the same one.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading