· 1 min read
People use these terms loosely, but the differences matter, because the defences are not the same.
Phishing
A message sent to many people at once, pretending to be a bank, a courier or a service you use, and asking you to click a link or sign in. It is a numbers game: most recipients ignore it, a few do not.
Spear phishing
The same idea, aimed at one person or one team. The attacker has done some homework: your name, your manager, a supplier you really use. The message reads as if it belongs in your inbox.
Business email compromise
The attacker takes over a real email account, or copies one closely, and then asks for money or information. A common version is a supplier whose bank details suddenly change. Because the message comes from a real account, filters often let it through.
What helps against all three
- A second sign-in step on every email account, so that a stolen password is not enough.
- A written rule that changes of bank details are confirmed by phone, on a number you already had.
- Email filtering that flags look-alike domains and unexpected links.
- A short, regular reminder to staff of what a convincing fake looks like.
- A clear, no-blame way to report a message that someone clicked on, quickly.
General information. It is not legal or professional advice for your situation.