What is phishing and how does spear phishing differ from general phishing?

• A. Phishing tricks users into revealing data; spear phishing targets a specific individual or organization with tailored messages
• B. Phishing is illegal; spear phishing is legal
• C. Phishing uses phone calls; spear phishing uses emails only
• D. Phishing is always successful; spear phishing is never successful

Answer: (A)

Phishing is a social engineering tactic where an attacker pretends to be a legitimate entity to trick you into revealing sensitive information like passwords or financial details. General phishing casts a wide net with generic messages sent to many people, hoping some will respond. Spear phishing, by contrast, is a targeted form that focuses on a specific person or organization and uses tailored content—drawing on details about the target to make the message seem believable. Because the message is personalized, spear phishing often seems more credible and can be more successful than broad, untargeted phishing.