Spear phishing is an extremely dangerous form of attack because it is personalized and targets a specific person or small group of people, using detailed information about them.

Carefully check the email address: Even if the sender’s name is familiar („Anna Kowalska”), always check the full email address. Look for subtle errors, letter swaps, or the use of a foreign domain (e.g., john.smith@company.com instead of the correct john.smith@companyname.com).

Be suspicious: If a close colleague or boss suddenly writes in a way that doesn’t fit their communication style (e.g., excessive formality, unusual requests, time pressure).

Confirm: If a message (email, SMS) asks you to take urgent action, such as making a transfer, changing a password, sending confidential financial data, or opening an unusual attachment – VERIFY it through another communication channel. Use the phone number you have saved or which is in the official company address book, not a number provided in the suspicious message.

Do not open attachments: Be very cautious if you receive a file you weren’t expecting, even from a familiar sender. Typical malicious extensions include .exe, .zip (compressed file) or .docm (document with macros).