Spear Phishing: Why Scam Messages Know So Much About You

Additional resource for the lesson “Phishing: Recognition and Prevention” — Online Privacy course

Spear phishing is a scam message written for one person: it uses your name, your job, a colleague or a recent event so that it feels familiar. This resource looks at phishing from the privacy side: where those details come from, how to check what is already out there about you, and how to leave less for the next message to use.

A. Why this matters

Phishing is usually explained as spotting fake messages and fake pages, and the Online Security course covers that. But phishing is also a way of collecting personal data: a password, an account number, an answer to a security question. And personal data is what makes a message believable.

This is where privacy comes in. Privacy, in this course, means three questions: what is known about you, by whom, and what you choose to let them know. A personalised scam message answers the first two, written by someone you never chose. Seeing how it was put together is where changing it starts.

A convincing message is not your fault. These messages are designed to feel ordinary, and noticing one is a skill you build, not a test you pass or fail.

What the sources say

The UK’s National Cyber Security Centre (NCSC) is direct about where the details come from. Its guidance on phishing scams explains that “criminals use information about you that’s available online (including on social media sites)” to make their messages more convincing. It suggests thinking about what you, and others, post about you, and reviewing your privacy settings.

Data breaches are the second source. The NCSC’s guidance for individuals says that criminals can use stolen data “when creating phishing messages (such as emails and texts) so that they appear legitimate”, and that such messages “may be sent some time after the breach is made public”. The UK’s Information Commissioner’s Office (ICO), the independent authority for data protection, makes the same point: “Criminals can use information from data breaches to impersonate trusted organisations”.

The Electronic Frontier Foundation (EFF), a digital rights organisation, explains that some phishing attacks are “targeted based on something the attacker already knows about an individual”. That is spear phishing. In the United States, the Federal Trade Commission (FTC) sums up what such messages are after: your passwords, account numbers or Social Security number.

B. Key concepts

Five ideas that connect phishing to what is known about you.

Phishing as data harvesting

A message, call or web page that pretends to come from someone you trust in order to get something from you. Often that something is data: a password, a one-time code, bank details.

Why it matters to you: It changes the question you ask. Not only “is this real?”, but “what is this asking me to hand over?”

Spear phishing

A phishing message written for one person or a small group, using details that fit them: a name, a role, a colleague, a trip. The EFF’s example is a fake email that seems to come from a relative.

Why it matters to you: A message that mentions something true about you feels trustworthy. Knowing that true details can be found or leaked helps you separate “this message knows me” from “this comes from someone I know”.

Your findable layer

Everything a stranger can find about you without asking you: what you post publicly, what others post about you, profiles that show your employer and job title, and listings that show your phone number, home address or email.

Why it matters to you: This is the raw material of spear phishing, and the part you can influence most. Each detail seems harmless; together they make a story.

Data breaches

A data breach is an incident in which data held by an organisation is exposed or stolen. Have I Been Pwned, a free breach-checking service that the NCSC mentions in its guidance, describes a breach as an incident “where data is inadvertently exposed in a vulnerable system”.

Why it matters to you: You cannot undo a breach, but you can find out whether your email appeared in one and change any exposed password, so an old leak opens nothing new. If a suspicious message quotes a password you have used, the NCSC says “don’t panic”: change it wherever you use it.

If you have already clicked

It happens, and it can be handled calmly. What matters is what you shared.

The NCSC’s steps: if you gave bank details, contact your bank. If you entered a password, change it on every account that uses the same one. If you opened a link or installed something on a computer, run a full antivirus scan. If you lost money, report it to Report Fraud in England, Wales and Northern Ireland, or to Police Scotland in Scotland. In the UK you can forward suspicious emails to the NCSC’s reporting address, and scam texts to 7726.

Why it matters to you: A clear sequence turns a worrying moment into a short list. Reporting helps others too: the NCSC uses reports to take scam websites down.

C. A practical example: Elena and the speaker’s invitation

Elena is 35 and works in marketing, handling client data every day. One Monday an email arrived that seemed to come from the organisers of an industry conference.

It used her full name and job title, mentioned the talk she had given there last spring, named the colleague who had spoken with her, and invited her back. To “confirm her slot”, she was to sign in to a speaker portal with her work email and password and upload last year’s slides.

Every detail was true, which is why nothing seemed wrong.

The request to sign in through a link made her pause. She found the organisers’ address on the conference’s own website and asked them. They had sent no such invitation.

What changed when Elena traced the details

Elena was not alarmed, only curious. That evening she did the exercise below and traced each detail:

• Her name, job title and employer were on her public professional profile.
• The talk and her colleague were in a public post, with a photo of them on stage.
• Her work email followed the same pattern as colleagues’ addresses listed publicly.
• A breach check showed her email in two breaches at services she had forgotten, one of which exposed a password.

She made three decisions. She still used the exposed password on two accounts, so she changed it on both and turned on a second factor for her main email. She limited the conference post to her contacts. And she forwarded the scam email to her company’s IT team, so colleagues could be warned.

She kept her professional profile public, because her work needs it. That was a choice too, now made knowing what it could be used for.

D. Try it yourself: see what a scammer could find (20 minutes)

Four short steps. They are not a test of how careful you are: they show you your findable layer, so you can decide what to do with it.

Step 1 — Check your email in data breaches (5 minutes)

• Type your main email address into a breach-checking service such as Have I Been Pwned. Its FAQ states that “searches are not logged”.
• Note each breach and what it exposed: email addresses, passwords, phone numbers.
• Finding nothing is useful information too. Finding some says nothing about your habits: the breaches happened at companies.

Step 2 — Look at yourself from outside (6 minutes)

• Search for your full name with your town, employer or job.
• Open your main profiles while signed out, or in a private window, to see roughly what a stranger sees.
• List the details a stranger could use: employer, job title, colleagues, family names, travel dates, your email address or its pattern.

Step 3 — Write the message a scammer could send you (4 minutes)

• Take three details from your list and imagine a short, believable message built from them.
• Note what it would ask you to do: sign in, pay, send a document, confirm a detail.
• That is the message worth being ready for. Having imagined it once, you may find it easier to pause.

Step 4 — Make one or two changes (5 minutes)

• If a breach exposed a password you still use, change it everywhere you use it.
• Choose one detail from step 2 that you do not need to show publicly, and limit who can see it.

• If your phone number, home address or email appears in search results, Google’s “Results about you” lets you request removal from Google Search. As Google notes, the information stays on the website itself.

The point is not to disappear. It is that what a stranger can find is what you chose to show.

Already covered in the Online Security course

How to Recognize Phishing When It Is Built to Be Convincing
It covers the security side: cloned pages, lookalike addresses, codes captured in real time and the bookmark habit, while this resource looks at the personal details that make a message convincing.

E. Videos, articles and further resources

Institutional sources first, then a digital rights guide and the tools mentioned in the exercise. All in English.

Institutional sources

NCSC (UK) — Phishing scams: how to spot and report them
How scam messages use information about you found online, and where to report emails, texts, calls and websites in the UK.
https://www.ncsc.gov.uk/collection/phishing-scams

NCSC (UK) — Data breach guidance for individuals
What to do after a breach at a company you use, including watching for the phishing that may follow.
https://www.ncsc.gov.uk/guidance/data-breaches

NCSC (UK) — Phishing scams: If you’ve shared sensitive information
Short steps for after you have clicked a link, entered a password or shared bank details.
https://www.ncsc.gov.uk/collection/phishing-scams/what-to-do

Information Commissioner’s Office (UK) — What steps can I take if I’ve been affected by a personal data breach?
The data protection regulator on how criminals may use breached data, and what to ask the organisation.
https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/what-steps-can-i-take-if-i-ve-been-affected-by-a-personal-data-breach/

FTC (US) — How To Recognize and Avoid Phishing Scams
What phishing tries to obtain, and what to do if a scammer has your information.
https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams

Digital rights guide

Electronic Frontier Foundation — How to: Avoid Phishing Attacks
Targeted phishing, and checking through a different channel with the supposed sender.
https://ssd.eff.org/module/how-avoid-phishing-attacks

Tools and platform documentation

Have I Been Pwned — FAQs
What the breach-checking service does and how it handles searches and notifications.
https://haveibeenpwned.com/FAQs

Google Search Help — Find and remove personal info in Google Search results
How “Results about you” finds your phone number, address or email in results and lets you request removal.
https://support.google.com/websearch/answer/12719076?hl=en

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner, where the work is understanding how what is known about you can be used, and choosing what to leave findable.

Skills

• Checking whether your email address has appeared in a known data breach.
• Seeing your own profiles roughly as a stranger does.
• Following the short list of steps after a click, calmly.

Awareness

• Recognising that a message which knows true details about you was assembled, not sent by someone you know.
• Knowing where those details come from: public posts and old breaches.
• Seeing phishing as data collection, which can feed the next message.

Secure Behaviour

• Checking unexpected requests through a channel you found yourself, not one given in the message.
• Changing any exposed password wherever you have used it.
• Keeping public only the details you have a reason to show.

G. Questions to sit with

• Which three details about you would make the most convincing scam message, and where can a stranger find them?
• Does an old account you no longer use still share a password with something important?
• When a message knows something true about you, what is your own first check?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Before you act on a message

• R16 — Be wary of emails pretending to be your bank: if a message asks for personal or bank details, contact the organisation through details you already have.
• R17 — Do not open unknown attachments, even when the message uses your name.
• R23 — Connect only with people you know, so that strangers cannot see the details you share with your contacts.

Minimum commitment: next time a message knows something true about you and asks you to act, check it through a channel you found yourself.

2. Making harvested data less useful

• R4 — Protect your accounts with a second factor, starting with your main email, so that a password exposed in a breach is not enough on its own.
• R29 — Watch for messages sent in your name: if an account is taken over, ask your contacts to treat recent messages from it with suspicion, as the NCSC advises.

Minimum commitment: check your main email address in a breach-checking service and change any exposed password you still use.

In short

• Spear phishing uses true details about you to feel familiar: the familiarity was assembled, not earned.
• Those details can come from what is findable online and from old data breaches.
• You can check your email in known breaches, see your profiles as a stranger does, and choose what stays public.
• If you have clicked, act on what you shared: tell your bank, change passwords you entered, scan the device, report it.

Related resources in this course

• Spam Calls: How Your Number Spreads and How to Cut Them
• Voice Cloning Scams: How Deepfakes Use What You Post
• Family Safe Word and Call-Back: Your Defence Against AI Scams
• Social Media Privacy Settings: A 10-Minute Visibility Check

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.