← ACARA Digital Technologies Years 7–8

Spear phishing

A phishing message aimed at one person or group that uses details like your name or school, or pretends to be a friend or teacher, to look more believable than mass phishing.

Part of: ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 15, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 29, WA Computer Science ATAR Year 11 — Cyber Security — Module 41

Understanding Spear phishing in ACARA Digital Technologies Years 7–8

What it does: The message uses the student's name, year level and school. These details are what make it spear phishing. The word 'spear' is a clue. Like a spear, the attack is aimed at a specific target. Mass phishing is the one sent to everyone. Attackers can find your name and teacher easily. A name alone does not prove the message is real. Check with the teacher in person. Spear phishing is a type of phishing. Both try to trick you into giving away data or clicking a bad link, but spear phishing is personalised.

Common mistakes: The message goes to one person and uses their name, so it is spear phishing. Mass phishing is sent to huge numbers of people with no personal details. The line should be type ← "spear phishing". A mass phishing message is sent to a huge number of people, so receivers should be a big number such as 50000, not 1. Sending to one person is a sign of spear phishing.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Spear phishing to a class →

This module's key terms are also in a printable crossword (Modules 635–666) and word search (Modules 635–695).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which message is an example of spear phishing?
An email that uses your name and says it is from your school principal asking for your loginAn email sent to thousands of people saying 'Dear customer, you won a prize'
Matches
Dear customer, you have won a prize! Click here. (called spear phishing)
↓
This is mass phishing, not spear phishing. It is generic and uses no details about one person or group.
Applying
Meanings
Term
spear phishing
Meaning
A phishing message aimed at one person or group that uses details like your name or school, or pretends to be a friend or teacher, to look more believable than mass phishing.
Practice
Spear phishing = aimed at one person or group
Testing
Gaps
IF usesYourName = THEN
Check Answer
Spots
3uses_name ← true
4type ← "mass phishing"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Arctic Fox' badge — Tundra Tracker, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which message is an example of spear phishing?
A. An email sent to thousands of people saying 'Dear customer, you won a prize'
B. An email that uses your name and says it is from your school principal asking for your login ✓
Spear phishing is aimed at one person or group and uses details about them. A generic message sent to thousands is mass phishing.
2. Spear phishing is a phishing message aimed at...
A. One person or a small group ✓
B. As many random people as possible
The word 'spear' is a clue. Like a spear, the attack is aimed at a specific target. Mass phishing is the one sent to everyone.
3. Why can spear phishing be harder to spot than mass phishing?
A. It uses real details about you, like your name or school, so it looks more believable ✓
B. It always has more spelling mistakes than other phishing messages
Personal details make the message feel real and trustworthy, so people are more likely to trust it.
4. You get a message that says 'Hi Sam, it's Mr Jones from Year 8 Science. Click here to see your test mark.' It was not expected. What is it most likely?
A. Possible spear phishing pretending to be a teacher ✓
B. A safe message because it uses your name
Attackers can find your name and teacher easily. A name alone does not prove the message is real. Check with the teacher in person.
5. Which is a sign of MASS phishing rather than spear phishing?
A. 'Hi Mia, I saw you at netball on Saturday. Open this link' sent only to Mia
B. 'Dear user, your account is locked' sent to a huge list of people ✓
Mass phishing is generic and has no personal details. Spear phishing is personal and written for one target.

Match the Pairs

spear phishing → A phishing message aimed at one person or group that uses details about them to look believable
mass phishing → The same generic phishing message sent to thousands of people, with no personal details
A spear phishing message can use your name and your school to look more believable → Hi Mia, your Year 8 account at Northside High is locked. Log in here to fix it.
A spear phishing message can pretend to come from a teacher you know → From: Mr Ford (English) - Please open this link to see your marked assignment.
Dear customer, you have won a prize! Click here. (called spear phishing) → This is mass phishing, not spear phishing. It is generic and uses no details about one person or group.
Spear phishing is safe to trust if it uses your real name and school. → Using your real name or school does not make a message safe. Attackers use these details to look believable.

Key Term

spear phishing
A phishing message aimed at one person or group that uses details like your name or school, or pretends to be a friend or teacher, to look more believable than mass phishing.

Fill in the Blanks

1. IF usesYourName = TRUE THEN type ← "spear phishing" ENDIF
Hint: Type the Boolean value that means the message does use your name.
2. IF sentToEveryone = TRUE THEN type ← "mass phishing" ENDIF
Hint: Type the variable name that says the message went out to huge numbers of people.
3. IF hasYourName OR hasYourSchool THEN type ← "spear phishing" ENDIF
Hint: Type the logic word that means either one of the two details is enough.
4. IF looksLikeTeacher = TRUE THEN type ← "spear phishing" ENDIF
Hint: Type the keyword that starts a decision in pseudocode.
5. IF isPersonal = TRUE THEN type ← "spear phishing" ENDIF
Hint: Type the keyword that closes the decision block.

Spot the Error

Question 1
A msg ← "Hi Sam, I am Ms Lee"
B receivers ← 1
C uses_name ← true
D type ← "mass phishing"
Line D — The message goes to one person and uses their name, so it is spear phishing. Mass phishing is sent to huge numbers of people with no personal details. The line should be type ← "spear phishing".
Question 2
A msg ← "Dear user, you won!"
B receivers ← 1
C uses_name ← false
D type ← "mass phishing"
Line B — A mass phishing message is sent to a huge number of people, so receivers should be a big number such as 50000, not 1. Sending to one person is a sign of spear phishing.
Question 3
A IF uses_name AND many_targets
B type ← "spear phishing"
C ELSE
D type ← "mass phishing"
Line A — Spear phishing is aimed at one person or a small group, so the test should be one_target, not many_targets. Many targets with no personal details points to mass phishing.
Question 4
A shown_name ← "Ms Lee"
B real_sender ← "Ms Lee"
C IF shown_name ≠ real_sender
D flag ← "spear phishing?"
Line B — A spear phishing message pretends to be a teacher, but the real sender is an attacker with a different address. The real sender should not match the shown name, otherwise the check would never flag it.
Question 5
A name ← "Mia"
B school ← "Park High"
C msg ← "Dear user, win!"
D type ← "spear phishing"
Line C — Spear phishing uses personal details like your name and school to look believable. A generic greeting such as 'Dear user' is typical of mass phishing. The line should build the message from name and school.

Student with a class code? Join your class →