Spear Phishing: Tactics, Reporting, and Federal Penalties

Spear phishing is a targeted email scam in which an attacker researches a specific person, then sends a personalized message designed to trick that individual into handing over credentials, data, or money. Unlike mass-market phishing, every detail is tailored to the target, which is why these attacks slip past people who would never fall for a generic scam. The FBI’s Internet Crime Complaint Center recorded $2.77 billion in losses from business email compromise in 2024, and spear phishing is the primary entry point for those schemes.¹ If you’ve been hit, the next hours matter: there are specific steps that can limit the damage, two federal portals that take reports, and a tax provision that may let you deduct part of what you lost.

How Spear Phishing Works

Regular phishing works like a dragnet. The same generic email goes to thousands of addresses, and the attacker counts on a small percentage biting. Spear phishing flips that approach. The attacker picks one person, spends days or weeks researching them, and builds a message that reads like it came from someone the target already knows.

The research phase is where the real work happens. Attackers comb LinkedIn profiles, corporate websites, press releases, and social media to learn a target’s job title, current projects, reporting structure, and personal interests. They look for details like which software vendor the company uses, the name of a direct supervisor, or a conference the target recently attended. All of that feeds into the message, giving it a specificity that spam never achieves.

The resulting email usually impersonates a colleague, vendor, or executive. It might reference a real invoice, a genuine internal project name, or an actual deadline. Because every detail checks out on the surface, the target has little reason to question whether the sender is who they say they are.

The Pressure Tactics That Close the Deal

Personalization alone doesn’t finish the job. Attackers layer in psychological pressure to push the target toward a specific action before they have time to think. The most common tactic is impersonating someone with authority, such as a CEO or department head, and framing the request as urgent and confidential. A message that appears to come from the CFO asking you to wire funds for a “time-sensitive acquisition” exploits both the authority dynamic and the deadline simultaneously.

Urgency is the attacker’s best friend. Messages often claim that an account will be locked, a payment will be missed, or a compliance deadline will expire unless the target acts within hours. That manufactured crisis short-circuits careful thinking. The emotional spike pushes people to act first and verify later, which is the wrong order.

Trust manipulation rounds out the approach. Attackers mimic the writing style, email signature, and tone of the person they’re impersonating. Some go further by compromising a real email account first, then sending the spear phishing message from that legitimate address. At that point, even a cautious employee may not see the threat, because the “from” field shows a colleague’s actual email.

What to Do in the First Hours

Speed matters more than anything after you realize you’ve been targeted. The faster you move, the better your chances of limiting the loss and preventing further use of whatever the attacker obtained.

Stop interacting with the message. If you clicked a link and landed on a page asking for credentials, close it without entering anything. If a file started downloading, cancel it and do not open it.
Disconnect from the internet. If malware may have been installed, disconnecting the device keeps it from transmitting stolen data or spreading on your network.
Call your bank. If you transferred money or entered payment information, call immediately. Many institutions can freeze or reverse transactions if notified quickly enough. Ask about a temporary hold on your accounts.
Change compromised passwords. Update the password for any exposed account, and for any other account sharing that password. Turn on two-factor authentication wherever available.
Place a credit freeze. Under federal law, you can freeze your credit reports for free at each of the three major bureaus (Equifax, Experian, and TransUnion). A freeze prevents anyone from opening new credit accounts in your name, which is critical if Social Security numbers or other personal data were exposed.²
Run a malware scan. Use updated antivirus software to scan for anything that may have been installed through a malicious link or attachment.
Build a recovery plan at IdentityTheft.gov. The Federal Trade Commission’s site generates a free personalized plan with pre-written letters and forms you can send to creditors and agencies.³

Document everything as you go. Save screenshots, note the dates and times of calls, and keep copies of correspondence with your bank and the credit bureaus. That documentation becomes essential when you file with federal authorities.

How to Report a Spear Phishing Incident

Two federal agencies accept spear phishing reports online, and the two reports feed different investigative pipelines. Filing with both is worth the effort.

FBI Internet Crime Complaint Center

IC3.gov is the FBI’s primary intake portal for internet crime. Before filing, gather the full email headers from the phishing message (these contain the sender’s server IP address and the message’s transmission path), the exact sender address, and any URLs or attachments included.⁴ Do not open suspicious attachments; preserve them.

The complaint form asks for your contact information, a detailed description of what happened, and financial transaction details if you lost money, including bank names, account numbers, transaction dates, and the total dollar amount.⁴ A chronological log of when you received the message and any actions you took afterward helps investigators build a timeline. Copy and paste the entire phishing email, including header information, directly into the complaint.

The IC3 may refer complaints to federal, state, local, or international law enforcement, including the FBI itself. In some cases, complaint data is shared with private-sector partners when the FBI determines sharing is necessary for an investigation, though personally identifiable information is generally withheld from those partners unless sharing it is essential.⁵

Federal Trade Commission

ReportFraud.ftc.gov accepts reports of fraud, scams, and deceptive business practices.⁶ The information you provide feeds into a database that law enforcement agencies across the country use to identify patterns and build cases. The FTC does not typically investigate individual complaints, but your report adds to the larger picture that triggers enforcement action against repeat offenders and organized schemes.

Save any confirmation numbers or copies of your submissions. Investigations are prioritized based on the severity of financial loss and the complexity of the scheme, so thorough documentation up front improves the chances your complaint gets attention.

Federal Criminal Penalties

Federal prosecutors typically stack charges in spear phishing cases, combining statutes based on the method of attack, the type of data stolen, and the financial harm caused. Penalties escalate quickly when multiple statutes apply to the same conduct.

Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act at 18 U.S.C. § 1030 is the backbone statute for unauthorized computer access. It covers anyone who intentionally accesses a “protected computer” without authorization and obtains information, commits fraud, or causes damage. The definition of “protected computer” is broad enough to cover essentially any device connected to the internet, because the statute reaches any computer “used in or affecting interstate or foreign commerce or communication.”⁷

A first offense involving unauthorized access to obtain information carries up to one year in prison, rising to five years if the access was for commercial gain, furthered another crime, or involved information worth more than $5,000. A second offense doubles the maximum to ten years. When the access was used to commit fraud, the first-offense maximum is five years, rising to ten for repeat offenders.⁷ Fines for any federal felony can reach $250,000 for individuals under the general federal sentencing statute.⁸

Wire Fraud

Wire fraud under 18 U.S.C. § 1343 applies whenever someone uses electronic communications to carry out a scheme to defraud. Any transmission by wire, radio, or television in interstate or foreign commerce for the purpose of executing a fraudulent scheme qualifies. Because spear phishing relies entirely on electronic communication to deceive victims, this statute fits naturally. Each fraudulent message can be charged as a separate count, carrying up to 20 years in prison and fines up to $250,000 per count.⁹⁸

Identity Theft and Aggravated Identity Theft

When an attack involves stealing or using someone else’s identifying information, prosecutors can add charges under 18 U.S.C. § 1028. The definition of “means of identification” is expansive, covering names, Social Security numbers, dates of birth, passwords, and biometric data. Penalties range from five to fifteen years depending on the type of document involved, rising to 20 years if the identity fraud facilitated drug trafficking or was a repeat offense.¹⁰

The real hammer is 18 U.S.C. § 1028A, aggravated identity theft. If someone uses another person’s identification during a felony like wire fraud or computer fraud, a mandatory two-year prison sentence gets added on top of whatever sentence the underlying felony carries. That two-year term runs consecutively, meaning it cannot overlap with the other sentence, and the court cannot reduce the underlying sentence to compensate. No probation is available.¹¹

Tax Deductions for Money You Lost

If you lost money to a spear phishing scam, you may be able to deduct part of that loss on your federal taxes. The IRS treats losses from criminal fraud as theft losses under Internal Revenue Code § 165, and the rules depend on whether the loss was tied to a profit-making activity.

For tax years 2018 through 2025, the Tax Cuts and Jobs Act suspended the deduction for personal theft losses unless the loss was attributable to a federally declared disaster. That restriction means most individual scam victims can only claim a deduction if the theft arose from “a transaction entered into for profit,” such as an investment scam where the victim believed they were making a legitimate financial transaction. The IRS has clarified that a profit motive can exist even when a scammer misleads you into moving money under the false belief that you’re protecting an existing investment or account.¹²

The TCJA’s suspension of personal theft loss deductions is scheduled to expire after 2025. If Congress does not extend it, individual victims of spear phishing in 2026 and beyond may be able to deduct theft losses even without a profit motive, though the deduction amounts would still be subject to statutory floors and limitations under § 165(h).

To claim a theft loss deduction regardless of the TCJA’s status, you have to meet three conditions. The loss must result from conduct that qualifies as theft under your state’s criminal law, you must have no reasonable prospect of recovering the stolen funds, and (for 2018 through 2025) the loss must arise from a profit-motivated transaction. The deduction is limited to your adjusted basis in the lost property, which for cash is simply the amount stolen. You claim the loss in the tax year you discover the theft, not the year it occurred.¹²

Report the loss using Section B of IRS Form 4684 (Casualties and Thefts) if it’s connected to a trade, business, or profit-seeking transaction. If insurance or your bank reimbursed part of the loss, only the unreimbursed portion is deductible.¹³ Filing a timely insurance claim is effectively required. If you skip it and the loss would have been partially covered, the IRS treats the potential reimbursement as though you received it.

If the Victim Is a Public Company

When a spear phishing attack hits a publicly traded company, the SEC requires disclosure of material cybersecurity incidents on Form 8-K within four business days of determining that the incident is material.¹⁴ The filing must describe the nature, scope, and timing of the incident, along with its material impact or reasonably likely impact on the company’s financial condition.¹⁵

The four-day clock starts when the company determines the incident is material, not when the incident itself occurs. The SEC expects that determination to happen “without unreasonable delay,” so a company cannot stall indefinitely before assessing significance. If required details aren’t available at the time of filing, the company must say so and amend the 8-K within four business days of obtaining the missing information.¹⁵ A narrow exception allows the U.S. Attorney General to delay disclosure for up to 120 days total if immediate disclosure would pose a substantial risk to national security or public safety.¹⁴ This rule applies only to public filers; private companies and individuals have no equivalent federal disclosure obligation on this timeline.

1
Internet Crime Complaint Center. 2024 IC3 Annual Report
2
Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
3
Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover From Identity Theft
4
Internet Crime Complaint Center. Frequently Asked Questions
5
Internet Crime Complaint Center. Privacy Policy
6
Federal Trade Commission. ReportFraud.ftc.gov
7
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
8
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
9
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
10
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents
11
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
12
Internal Revenue Service. Chief Counsel Advice Memorandum 202511015
13
Internal Revenue Service. Instructions for Form 4684
14
U.S. Securities and Exchange Commission. Form 8-K
15
U.S. Securities and Exchange Commission. Disclosure of Cybersecurity Incidents Determined To Be Material