The email arrives at 11:43 AM on a Tuesday. It’s addressed to you by your full name — not “Dear Customer,” your actual name. It’s from HDFC Bank. It mentions your Savings Account, references a transaction of ₹14,200 processed two days ago, and says there’s an unusual login attempt from Mumbai. Your home city, listed in the sender’s support signature, matches the city you actually live in.
It asks you to verify your account by clicking a link. The link looks right. The logo looks right. Everything looks right.
Most people click.
The short answer. Spear phishing is a targeted phishing attack built from real details about you: your name, your bank, your last transaction, your city. Attackers assemble those details from data breaches, people-search sites, and LinkedIn, often in under thirty minutes. The details make the message feel legitimate, but they don’t make it real. The defense doesn’t depend on spotting the fake: check the raw sender address, hover over links before clicking, and call the organization back on a number you find yourself, never a number in the email. Treat any urgent “verify within 24 hours” demand as a red flag.
The email that knew too much
Here’s what that email actually is: a spear phishing attack, built from at least four separate data sources, assembled specifically about you before the attacker ever hit send.
Generic phishing — “Your account has been suspended, click here” — is easy to ignore. You get ten of those a week and you’ve learned to delete them without thinking. Spear phishing is categorically different. It targets a specific individual using real personal information pulled from data breaches, public profiles, and people-search sites. According to Symantec Internet Security Threat Reports from 2012–2015, spear phishing accounted for 65% of targeted attacks. That figure predates major industry shifts, and more recent data from threat intelligence providers may differ. The FBI’s Internet Crime Complaint Center reported average business email compromise losses of $125,000 per incident in 2023.
The reason the numbers are that bad is simple: the attacks work.
Where they got every detail
Walk back through that example email and trace each piece of information.
Your full name came from a breach database — your email was exposed in a breach (check haveibeenpwned.com), and that record included your name alongside it. The 2021 LinkedIn scrape exposed 700 million records. The 2020 Juspay breach exposed approximately 100 million records (including masked card data, email addresses, and phone numbers).
Your bank name — HDFC, Barclays, Chase — came from a financial data breach, a loyalty program that sold spending-category data to third parties, or simple inference (if 40% of your city banks with HDFC, the attacker guesses HDFC and is right often enough).
The transaction amount is the detail that unnerves people most. Some financial breaches include partial transaction history. Others don’t — but a confident approximation triggers the same response as an exact match. You remember spending roughly that amount and your brain fills the gap.
Your home address is on a data broker site right now, probably several of them. Whitepages, Spokeo, TruePeople Search, and Indian equivalents like TrueCaller’s directory all aggregate public records and sell or display personal addresses.
Your employer is on LinkedIn.
A convincing spear phish typically references three to five real personal details. Assembling five data points takes an attacker under thirty minutes with the right tools.
The enrichment step
Attackers don’t stop at a single breach. The real craft — and this is worth understanding — is data enrichment: cross-referencing multiple sources to build a profile richer than any individual source could provide.
Your email address from one breach gets your home address appended from a people-search site. Your employer from LinkedIn. Your approximate bank from a financial data leak. Then free OSINT tools like Maltego and theHarvester automate the aggregation, pulling together everything that’s publicly or semi-publicly available about you in one structured profile.
The result isn’t just your name and email. It’s a dossier. And it costs the attacker nothing but time.
What makes spear phishing so effective
There’s a specific cognitive mechanism that spear phishing exploits, and once you understand it, you’ll see it in every successful attack.
Security researchers call it the authority-plus-familiarity override. When an email invokes a familiar institution (your actual bank) and includes details that feel personally known (your name, your transaction), your brain’s pattern-matching engine fires before your conscious evaluation starts. It reads “legitimate” before you’ve checked anything. Generic phishing triggers neither authority nor familiarity, so your skepticism has room to engage. Spear phishing collapses that room.
Urgency compounds the problem. “Unusual login detected — verify within 24 hours or your account will be locked.” Urgency is a manipulation tactic, not a business practice — no legitimate bank sends you a 24-hour ultimatum before locking your account. But when authority, familiarity, and urgency hit simultaneously, the override is powerful enough to work on people who know better.
How to spot it even when it knows your details
The good news: even a technically convincing spear phish leaves tells. You just have to know where to look.
Check the actual sender address, not the display name but the raw address. The display name can be set to anything: “HDFC Bank Security Team,” “Amazon Customer Service.” The actual email address is harder to fake convincingly. Look for it: hdfcbank-security@hdfc-verify-account.net is not HDFC Bank.
Hover over every link before clicking. The destination URL will appear in your browser’s status bar or as a tooltip. https://secure-hdfc-login.pages.dev is not hdfc.com.
Call the organisation directly on a number you find yourself. Use the back of your card, or the official website reached by typing the URL yourself. Not a number from the email. This single step would stop the vast majority of spear phishing attacks cold.
Notice the request pattern. Banks don’t ask for OTPs over email. No legitimate service asks you to “verify” by entering your full password. Any email asking you to bypass your normal login process is suspect by design.
And again: urgency is the tell. Legitimate organisations give you time. Attackers create artificial time pressure because it works. The moment you feel rushed, slow down.
Vishing: the call-based version
The same attack runs over phone calls. You get a call from someone who knows your name, knows you bank with HDFC (or Barclays, or Chase), and can quote your last transaction amount back to you. They’re calling to help you stop the fraudulent activity on your account. They just need to verify your identity, starting with your OTP.
This is vishing — voice phishing — and the enrichment process behind it is identical to the email version. The caller built the same dossier using the same data sources. The call just adds a voice and real-time social pressure that email can’t replicate.
The defence is the same: hang up and call back on the official number. Not the number the caller gives you — the number on the back of your card or the bank’s official website. If the situation was real, the bank will tell you. If it was a vishing attack, hanging up ended it.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.