When the Phish Knows Your Name: Defending Against Targeted Lures

Phishing in 2025 rarely looks like the clumsy, misspelled emails of a decade ago. Following large breaches such as the PowerSchool incident, attackers hold rich context: real names, real relationships, and real details they can weave into convincing lures. Awareness training has to evolve with that reality.

Why generic advice falls short

Telling staff to watch for spelling mistakes and to hover over links is no longer enough. Modern lures are well written, often assisted by AI, and may reference genuine projects, colleagues, or recent events. Some arrive by text message or voice call rather than email. The tell is less about typos and more about the request itself.

Teach the shape of an attack

• Urgency and secrecy. A message that pressures you to act fast and keep quiet is a red flag regardless of how polished it looks.
• Changes to money or access. New banking details, an unexpected password reset, or a request to approve access deserve independent verification.
• Channel switching. An email that pushes you to a text or a phone call is trying to escape controls.

Building durable habits

Give employees a simple, repeatable reflex: for any request involving money, credentials, or sensitive data, verify through a separate trusted channel before acting. Make reporting easy and blameless. A one-click report button and a culture that thanks people for flagging suspicious messages will surface attacks far earlier than punishment ever will.

Takeaway

Assume attackers know real details about your people and processes. Train staff to recognize the shape of a manipulation, especially urgency plus a request for money or access, make reporting effortless and blameless, and verify sensitive requests through a second channel every time.