What is clone phishing?
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Definition
Clone phishing is a phishing attack that copies a real email you already received, such as a receipt or a document share, and resends it from a lookalike address with the link or attachment swapped for a malicious one.
- Category
- Attacks
- Also called
- cloned email phishing, email cloning attack
- Last updated
Sources checked: nvlpubs.nist.gov, csrc.nist.gov
Last verified against the official page:
NIST lists clone phishing as one of the variations of phishing, the tactic of tricking people into giving up information or installing malware by pretending to be someone they trust. What sets clone phishing apart is the starting point: the attacker begins with a message that was genuine.
Here is how a typical case goes. You get a real email from your bank or a coworker with a link to a statement or a shared file. Later, a near-identical email arrives. It has the same subject, the same wording and the same logo, and it often says it's a resend or an updated version. The sender address is a lookalike or a spoofed copy of the original. The link now leads to a fake login page, or the attachment carries malware.
The copy works because you've already seen the original. Familiarity lowers your guard, and "resending" gives a believable reason for getting the same message twice.
How it differs from related terms
- Phishing is the general category: any message that impersonates a trusted sender to get you to act.
- Spear phishing is aimed at one person or group and written around details about them. A clone attack doesn't need those details, only a real message the attacker got hold of or can imitate.
- Whaling targets senior executives.
Why it matters
A fake login page captures your password, and a malicious attachment can install malware. Either can lead to account takeover, and stolen logins are often reused to attack other accounts, so one click can cost you more than one account.
How to protect yourself
- 1
Check the sender address, not just the name
A cloned email can carry the same display name as the real one. Look at the full address and compare it with the original message you received.
- 2
Don't click a link in a message you didn't expect twice
Open the company's website by typing the address yourself or using a saved bookmark, and check your account from there.
- 3
Confirm through another channel
If a colleague or company seems to have resent a file, ask them using a phone number or chat you already know is theirs.
- 4
Turn on two-step verification
If you do enter a password on a fake page, a second step makes the stolen password less useful by itself. Use an app or security key where you can.
- 5
Report it
In the US you can report phishing emails to reportphishing@apwg.org and to the FTC at ReportFraud.ftc.gov. Elsewhere, use your national reporting service, such as the NCSC's Suspicious Email Reporting Service in the UK.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is clone phishing the same as spear phishing?
No. Spear phishing is tailored to a specific target using details about them. Clone phishing reuses a real, earlier email and swaps in a malicious link or attachment, and it can be sent to many people.
Why does a clone phishing email look so real?
It's built from a message that was genuine, so the wording, layout and branding match. Only the sender address details and the link or attachment differ.
What should I do if I clicked the link?
Change the password for that account right away, and for any other account that uses the same one. Turn on two-step verification and report the message. If you entered financial details, contact your bank.
Sources
Something wrong or out of date? Tell us and we'll re-check it.