- Phishing is the umbrella term. The other names describe who is targeted (spear phishing, whaling) or which channel is used (smishing, vishing, quishing).
- Spear phishing is personal; ordinary phishing is sent to many people at once.
- AI makes personal messages cheap, so the line between mass and targeted phishing is fading.
- The same few habits protect against every type: check the request, verify on a channel you choose, and report quickly.
The eight types, defined
Each one starts with a one-line definition, then a short made-up example.
1. Phishing
Phishing is a fraudulent message, usually an email, sent to many people at once to trick them into clicking a link, opening an attachment or handing over details. It's the umbrella term for everything below. The message is generic because it doesn't need to fool everyone, just a few.
Example: “Your mailbox is 98% full. Upgrade your storage now or new messages will be rejected,” sent to thousands of addresses.
2. Spear phishing
Spear phishing is phishing aimed at a specific person or small group, using details about them to make the message believable. The attacker might use your name, job title, manager, suppliers or a recent project, often found on a company website or social media.
3. Whaling
Whaling is spear phishing aimed at senior people, such as owners, directors or finance leads, who can approve payments or reach sensitive information. In a small business, that's often the founder, who also tends to be the busiest person in the building.
Example: A director receives a formal “notice of claim” from a solicitor's office about a contract dispute, with a link to “view the court papers”.
4. Smishing
Smishing is phishing by text message or messaging app. Phones show less of the sender and the link, and people tend to act on texts quickly. In the UK you can forward suspicious texts to 7726, which is free.
Example: “We missed you today. Pay a £1.45 redelivery fee to rebook your parcel,” with a short link.
5. Vishing
Vishing is phishing by phone call or voicemail, where the attacker talks you into acting. AI voice cloning means the caller can now sound like someone you know. We cover this in voice clones and deepfake CEO fraud.
Example: “Hi, it's IT. We're seeing odd sign-ins on your account. I'll send you a code; just read it back to me so I can lock it down.”
6. Quishing
Quishing is phishing that hides a malicious link inside a QR code. The code hides where it goes, and scanning moves you to your phone, away from your work protections. More in how quishing works and how to spot it.
Example: An email with a PDF saying “Scan to re-verify your account before Friday,” and a QR code in the middle.
7. Clone phishing
Clone phishing copies a genuine email you've already received and resends it with the link or attachment swapped for a malicious one. Because you recognise the message, you're less likely to look closely.
Example: A copy of last week's real “document shared with you” email, marked “Resending: the previous link expired.”
8. Business email compromise (BEC)
Business email compromise is a scam in which a criminal uses a hijacked or lookalike business email account to pose as someone you trust, usually to redirect a payment. There's often no link at all, just a request. See our guide to business email compromise and invoice fraud and payment diversion.
Example: “Hi Sarah, we've moved banks. Please use the new details below for this month's invoice,” from a supplier's real but taken-over mailbox.
How AI blurs the line between mass and targeted phishing
The old split was about effort. Mass phishing was cheap and generic. Spear phishing took research and careful writing, so attackers saved it for people worth the time.
Generative AI removes most of that effort. A tool can read a company website, pick out names and roles, and write a fluent, personal email for each person on a list in seconds. A campaign sent to thousands can now feel as if it were written for you. We cover what that means for spotting them in how to spot AI-written phishing emails.
So the labels matter less than they used to. Don't ask “is this a mass email or a targeted one?” Ask “what is this message asking me to do, and how can I check it?”
The habits that work for all of them
Whatever the channel or the target, the same short pause protects people.
- Judge the request, not the writing. Logins, payments, codes, bank details and files from people you weren't expecting all deserve a second look, however polished the message.
- Check where it really goes. Read the sender's full address, hover over links, and be wary of QR codes and short links.
- Verify on a channel you choose. Call a number you already have, or message the person directly. Never use the contact details in the message itself.
- Slow down when rushed or told to keep quiet. Urgency and secrecy are there to stop you checking.
- Report quickly, without blame. If you've clicked, say so straight away. Our clicked-a-link checklist walks through what to do next.
Habits come from practice, not posters. Lureproof sends small teams on Google Workspace or Zoho realistic practice emails and turns a click into a 60-second lesson. It covers the email-based types above; it doesn't send practice texts or phone calls. It's free for up to five people, and our free security training is open to everyone.
FAQ
What is the difference between phishing and spear phishing?
Phishing is sent to many people at once with a generic message. Spear phishing is aimed at a specific person or small group and uses details about them, such as their name, role or colleagues, to seem believable.
What are the main types of phishing?
The common types are phishing, spear phishing, whaling, smishing (text messages), vishing (phone calls), quishing (QR codes), clone phishing and business email compromise. They differ in channel and target, but almost all rely on urgency and an unusual request.
Is whaling the same as spear phishing?
Whaling is a type of spear phishing that targets senior people, such as owners, directors or finance leads, because they can approve payments or reach sensitive information.