Bulk email phishing is the most common type of phishing attack. A scammer creates an email message that appears to come from a large, well-known legitimate business or organization—a national or global bank, a large online retailer, the makers of a popular software application or app—and sends the message to millions of recipients. Bulk email phishing is a numbers game: The larger or more popular the impersonated sender, the more recipients who are likely to customers, subscribers or members.

The phishing email addresses a topic that the impersonated sender might credibly address, and that appeals to strong emotions—fear, greed, curiosity, a sense of urgency or time pressure—to get the recipient's attention. Typical subject lines include 'Please update your user profile,' 'Problem with your order,' 'Your closing documents are ready to sign,' Your invoice is attached.' 

The body of the email instructs the recipient to take an action that seems perfectly reasonable and consistent with the topic, but will result in the recipient divulging sensitive information—social security numbers, bank account numbers, credit card numbers, login credentials— or downloading a file that infects the recipient's device or network. For example, recipients might be directed to 'click this link to update your profile', but the link takes them to a fake website, where they enter their actual login credentials while ostensibly updating their profile. Or they may be told to open an attachment that appears to be legitimate (e.g., 'invoice20.xlsx') but that delivers malware or malicious code to the recipient's device or network.

Spear phishing is a phishing attack that targets a specific individual - usually a person who has privileged access to sensitive data or network resources, or special authority that the scammer can exploit for fraudulent or nefarious purposes.

A spear phisher studies the target to gather information needed to pose as a person or entity the target truly trusts—a friend, boss, co-worker, colleague, trusted vendor or financial institution—or to pose as the target individual. Social media and social networking sites—where people publicly congratulate coworkers, endorse colleagues and vendors, and tend to overshare about meetings or events or travel plans - have become rich sources of information for spear phishing research. 

Armed with this information, the spear phisher can send a message containing specific personal details or financial information and a credible request to the target—as in, 'I know you're leaving tonight for vacation—can you please pay this invoice (or transfer USDXXX.XX to this account) before close of business today?'

Some spear phishing emails attempt to gather even more information, in preparation for a larger-scale attack. For example, a spear phishing message might ask a CEO to update their email account credentials lost during a brief outage, but provide a link to a malicious fake website designed to steal those credentials instead. With those credentials in hand the attacker has full access to the CEO’s mailbox—they can study the CEO's email messages for even more information, and send a convincing, fraudulent message directly from the CEO's email account, using the CEO's actual email address. 

This is an example of business email compromise (BEC), a particularly dangerous type of spear phishing attack designed to trick company employees into sending very large sums of money or valuable assets to an attacker. BEC emails are sent or appear to be sent from the email accounts of the highest-ranking members of the business —or from high-level associates of the business, such as attorneys, key business partners or large vendors—and contain enough detail to appear highly credible.

Spear phishing isn't the only tactic for getting the information needed to stage successful BEC attack. Hackers can also deploy malware or exploit system vulnerabilities to gain access to email account data. Or, if they can't gain access to account data, hackers can try spoofing the sender's address—using an email address so similar to the sender's actual address that the recipient doesn't notice the difference. 

Regardless of tactics, successful BEC attacks are among the costliest cyberattacks. In one of the best—known examples of BEC, hackers impersonating a CEO convinced his company's finance department to transfer nearly 50 million euros to a fradulent bank account.

Organizations are encouraged to teach users how to recognize phishing scams, and to develop best-practices for dealing with any suspicious emails and text messages. For example, users can be taught to recognize these and other characteristic features of phishing emails:

- Requests for sensitive or personal information, or to update profile or payment information
- Requests to send or move money
- File attachment(s) the recipient did not request or expect
- A sense of urgency, whether blatant ('Your account will be closed today...') or subtle (e.g., a request from a colleague to pay an invoice immediately) threats of jail time or other unrealistic consequences
- Threats of jail time or other unrealistic consequences
- Poor spelling or grammar
- Inconsistent or spoofed sender address
- Links shortened using Bit.Ly or some other link-shortening service
- Images of text used in place of text (in messages, or on web pages linked to in messages)

This is only a partial list; unfortunately, hackers are always devising new phishing techniques to better avoid detection. Publications such as the Anti-Phishing Working Group's quarterly Phishing Trends Activity Report (link resides outside of ibm.com) can help organizations keep pace. 

Organizations can also encourage or enforce best practices that put less pressure on employees to be phishing sleuths. For example, organizations can establish and communicate clarifying policies - e.g., a superior or colleague will never email a request to transfer funds. They can require employees to verify any request for personal or sensitive information by contacting the sender or visiting the sender's legitimate site directly, using means other than those provided in the message. And they can insist that employees report phishing attempts and suspicious emails to the IT or Security group.

Despite the best user training and rigorous best practices, users still make mistakes. Fortunately, several established and emerging endpoint and network security technologies can help security teams pick up the battle against phishing where training and policy leave off.

- Spam filters combine data on existing phishing scams and machine learning algorithms to identify suspected phishing emails (and other spam), then move them to a separate folder and disable any links they contain.
- Antivirus and anti-malware software detects and neutralizes malicious files or code in phishing emails.
- Multi-factor authentication requires at least one login credential in addition to a username and a password—for example, a one-time code sent to the users' cell phone. By providing and additional last line of defense against phishing scams or other attacks that successfully compromise passwords, multi-factor authentication can undermine spear phishing attacks and prevent BEC. 
- Web filters prevent users from visiting known malicious web sites ('blacklisted' sites) and display alerts whenever users visit suspected malicious or fake web sites.

Centralized cybersecurity platforms - e.g. security information and event management (SIEM), endpoint detection and response (EDR), network detection and response (NDR) and extended detection and response (XDR) - combine these and other technologies with continually updated threat intelligence and automated incidence response capabilities that can help organizations to prevent phishing scams before they reach users, and to limit the impact of phishing attacks that get past endpoint or network defenses.