Spear phishing vs phishing vs whaling: what's the difference?

Phishing, spear phishing and whaling are often used as if they mean the same thing. They don't. They describe how widely an attacker casts the net and how much research goes into the bait. The difference matters because each one gets past a different layer of your defenses.

What is phishing?

Phishing is the broad category. The NIST glossary quotes RFC 4949: "A technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person."

CISA's joint phishing guidance with the NSA, FBI and MS-ISAC describes phishing as "a form of social engineering where malicious actors lure victims (typically via email) to visit a malicious site or deceive them into providing login credentials." It names two main goals: stealing login credentials and deploying malware.

When people say "phishing" without a qualifier, they usually mean mass phishing: the same message sent to thousands or millions of addresses. A fake delivery notice, a "your mailbox is full" warning or a bogus password expiry are typical. The attacker doesn't know who you are. They're counting on a small percentage of recipients clicking.

What is spear phishing?

Spear phishing is phishing aimed at a specific target. MITRE ATT&CK puts it plainly: "Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary."

The UK's National Cyber Security Centre explains what makes it work. In its guidance for organizations, it says a phishing email "could be the first step in a targeted attack against your company, or a specific employee. In these targeted campaigns, the attacker uses information about your employees or company to make their messages even more persuasive and realistic. This is usually referred to as spear phishing."

That information is easy to find. The NCSC points to your "digital footprint", the information freely available on your website and social media accounts, and warns that partners, contractors and suppliers can give details away too. A spear phisher might know your name, your manager's name, your suppliers, the software you use and the project you're working on.

What is whaling?

Whaling is spear phishing aimed at the most senior people. The NCSC describes "personalised whaling attacks (a type of spear phishing that targets a 'big phish', such as a board member who has access to valuable assets)."

The targets are executives, board members, owners and the people closest to them, such as executive assistants. They're worth the extra effort because they can approve payments, authorize exceptions and access confidential information. Senior people are also often the most public, so there's plenty of material to research.

The term is sometimes used loosely for attacks that impersonate executives rather than target them. That's usually called CEO fraud, and it's a form of business email compromise.

Phishing vs spear phishing vs whaling: comparison table

What do the three types look like?

These are illustrative examples, not real incidents.

A mass phishing email

From: Microsoft 365 <no-reply@m365-alerts-center.example> Subject: Your password expires today

Your password will expire in 24 hours. Keep your current password to avoid losing access. [Keep Current Password]

It's generic, it could go to anyone, and it links to a fake sign-in page. Our guide to how to spot a phishing email walks through the signs.

A spear phishing email

From: Dana Ruiz <dana.ruiz@northwind-supp1ies.example> Subject: Re: Q3 order 4471, updated invoice

Hi Sam, following up on our call last week. Our bank details changed after the audit, so please use the attached invoice for the Q3 order. Thanks for sorting this before Friday.

It names a real supplier contact, a real order and the recipient's first name. The domain is a lookalike of the real supplier's, with a digit 1 in place of the letter l in "supplies". There's no malicious link, just a request to pay a new account. This is the pattern behind vendor invoice fraud.

A whaling email

From: "James Okafor (Board Chair)" <j.okafor.board@freemail.example> To: CEO Subject: Confidential: acquisition, NDA required

We need to move on the acquisition before the announcement. Outside counsel will contact you today. Please keep this between us and approve the escrow transfer they send.

It targets the CEO directly, uses the board chair's real name in the display name on a free webmail address, demands secrecy, and sets up a follow-up from a fake "lawyer". Everything about it is designed to bypass normal approval.

Why are targeted attacks harder to stop?

Mass phishing gives defenders a lot to work with. The same message hits many mailboxes at once, it often comes from known bad infrastructure, and it usually carries a link or attachment that can be scanned.

Targeted attacks remove most of those signals:

• Low volume. One message to one person looks like ordinary business mail.
• Clean or real senders. Attackers register lookalike domains with valid SPF, DKIM and DMARC, or send from a genuinely compromised account. Microsoft's anti-phishing documentation notes that impersonation "can pass email authentication checks (SPF, DKIM, and DMARC) if the attacker created a lookalike domain and published valid DNS records."
• No payload. A request to change bank details contains nothing for a malware scanner to find.
• Believable context. Correct names, roles and projects defeat the "does this look generic?" test that training relies on.

The NCSC's view on training is worth quoting: "spotting all phishing emails is hard, and spear phishing attacks are even harder to detect." Training still helps. It just can't be the only layer.

How do you defend against each type?

Against mass phishing

1. Filter inbound mail for spam, malware and known phishing infrastructure. See how spam filters work.
2. Publish DMARC at enforcement on your own domains so attackers can't send exact-domain spoofs of you. The NCSC guidance recommends DMARC, SPF and DKIM for exactly this reason.
3. Use phishing-resistant MFA. CISA's guidance says FIDO or PKI-based MFA is "phishing resistant", so a stolen password alone isn't enough.
4. Make reporting easy, with a report button in every mail client.

Against spear phishing

1. Verify requests out of band. Any change to bank details, any new payee and any request for credentials or sensitive data gets confirmed by phone using a number you already have. CISA's advice: "If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly", using contact details that don't come from the message.
2. Turn on impersonation and lookalike-domain protection. In Microsoft Defender for Office 365, user impersonation protection covers up to 350 users per anti-phishing policy, and the first contact safety tip is available on all Microsoft 365 cloud mailboxes.
3. Tag external mail so a message "from" a colleague that actually came from outside stands out.
4. Reduce your digital footprint. The NCSC suggests considering what visitors to your website need to know, "and what detail is unnecessary (but could be useful for attackers)".

Against whaling

1. Require two people for large or unusual payments, and make the rule apply to the CEO too. A process that the CEO can override by email is the exact gap whaling exploits.
2. Agree a verification habit with executives. Senior staff should expect to be called back, and assistants should feel safe asking.
3. Protect executives' accounts first with phishing-resistant MFA, because a compromised executive mailbox makes every later attack credible.
4. Add executives and their assistants to impersonation protection, and watch for lookalike domains of your own.
5. Give the most-targeted people extra support. The NCSC notes that staff who "access sensitive information, manage financial assets, or administer IT systems will be of greater interest to an attacker" and should be offered additional support.

Where does business email compromise fit?

Business email compromise (BEC) is the money-focused end of spear phishing and whaling. It uses targeted emails to get a payment or sensitive data, often with no link or attachment at all. Gift card requests, payroll diversion and fake supplier invoices are all BEC. Our BEC prevention guide covers payment procedures and the technical controls in detail.

Next steps

• Write down a payment-change procedure that requires a phone call to a known number, and apply it to everyone, executives included.
• Check that your own domain can't be spoofed: run the DMARC Checker and move toward p=reject.
• List your most-targeted people (finance, payroll, executives, assistants, IT admins) and give them phishing-resistant MFA and impersonation protection first.
• Review what your website and staff profiles reveal, and remove details attackers would find useful.
• Put an inbound filter in front of your mailboxes. iBlockSpam filters spam, malware and phishing at the MX level, with personal quarantine for every user. Our email security checklist for small businesses covers the rest.