Clone Phishing: When Legitimate Emails Turn Dangerous
Clone phishing is a sophisticated attack where cybercriminals intercept or recreate legitimate emails from trusted organizations, then resend nearly identical copies with malicious links or attachments. Unlike traditional phishing that creates fake emails from scratch, clone phishing leverages the credibility of real communications you've previously received or expect to receive. Attackers typically monitor email traffic, duplicate a genuine message from your bank, employer, or service provider, and replace legitimate links with malicious ones that lead to credential-harvesting websites or malware downloads. This technique has grown 35% year-over-year according to the FBI's 2023 Internet Crime Report, with average losses reaching $2,000 per victim. The attack is particularly effective because the cloned email often arrives shortly after the legitimate one, appears in the same email thread, and contains identical branding, logos, and messaging. Clone phishing attacks frequently target business professionals during invoice processing, password reset requests, and software update notifications. The danger of clone phishing lies in its exploitation of established trust relationships. When you receive what appears to be a follow-up message from your IT department or a second notice from your credit card company, your guard is naturally lower than with unexpected communications. Attackers exploit this psychological vulnerability, knowing that recipients are more likely to click links in messages that appear to continue legitimate conversations. The Federal Trade Commission reported that business email compromise schemes involving clone phishing resulted in over $2.7 billion in losses in 2023, making it one of the costliest forms of cyber fraud.
Common Tactics
- •Intercepting legitimate emails through compromised email accounts or man-in-the-middle attacks, allowing attackers to see genuine communications before cloning them with malicious modifications.
- •Creating identical copies of emails from trusted senders like banks, employers, or service providers, replacing only the embedded links or attachments while keeping all other content, branding, and formatting unchanged.
- •Timing cloned emails to arrive within hours or days of the legitimate message, often claiming to be a follow-up, correction, or urgent update that requires immediate action.
- •Spoofing sender addresses to appear as if the cloned email comes from the same legitimate source, using techniques like display name manipulation or similar-looking domains.
- •Embedding malicious links that redirect to credential-harvesting login pages designed to look identical to legitimate websites, capturing usernames and passwords when victims attempt to log in.
- •Using compromised email accounts of colleagues, partners, or known contacts to send cloned messages, making the attack appear to originate from within trusted networks and increasing credibility.
How to Identify
- Receiving duplicate or near-duplicate emails about the same topic within a short timeframe, especially if they claim the previous message contained an error or requires urgent action.
- Noticing slight discrepancies in sender email addresses, such as extra characters, numbers, or similar-looking domains that differ by one letter from the legitimate source.
- Finding that links in the email, when hovered over, show URLs that don't match the legitimate organization's domain or redirect through unfamiliar shortened URLs or IP addresses.
- Detecting unexpected urgency in follow-up messages that claim your account will be suspended, payment was declined, or immediate verification is required, when the original communication had no such urgency.
- Observing minor formatting inconsistencies, unusual font changes, or small alterations in logos or signatures that weren't present in previous legitimate emails from the same sender.
- Receiving password reset requests, invoice updates, or shipping notifications that you didn't initiate, especially if they arrive shortly after receiving a similar legitimate communication.
How to Protect Yourself
- Verify suspicious emails by contacting the sender through a separate, independently obtained communication channel such as a phone number from the official website, never using contact information from the questionable email itself.
- Manually type website URLs directly into your browser rather than clicking links in emails, especially for banking, email, or other sensitive accounts that require login credentials.
- Enable multi-factor authentication on all critical accounts including email, banking, and work systems, which prevents attackers from accessing accounts even if they obtain your password through clone phishing.
- Hover over all links before clicking to inspect the actual destination URL, and be suspicious of any link that doesn't lead to the organization's legitimate domain or uses URL shorteners.
- Implement email filtering rules and security software that detects spoofed sender addresses, flags external emails claiming to be from internal sources, and warns about emails with suspicious characteristics.
- Establish verification procedures with your organization for financial transactions, invoice changes, and sensitive requests that require confirming through a second communication method before taking action.
Real-World Examples
A small business owner received what appeared to be a second notice from their office supply vendor about an outstanding invoice for $1,850. The email was identical to a legitimate invoice received two days earlier, including the same order details and vendor logo. The only difference was a link to "view updated payment details" that led to a fake payment portal. After entering their banking credentials to make the payment, the attacker drained their business checking account of $12,400 before the fraud was discovered.
An employee at a technology company received a cloned email appearing to come from their IT department, asking them to verify their Microsoft 365 account following a security update. The email was an exact copy of a legitimate IT notice sent company-wide three hours earlier. The employee clicked the verification link and entered their credentials on a convincing fake login page. Within 30 minutes, the attacker accessed the employee's email account and sent payment redirect requests to the company's clients, resulting in $47,000 in diverted payments.
A homeowner received a cloned email from what appeared to be their mortgage servicer, requesting confirmation of escrow account details. The message arrived one day after a legitimate annual escrow analysis statement. Believing it was a follow-up to ensure accuracy, the homeowner clicked the link and provided their online banking credentials. The scammer used these credentials to initiate wire transfers totaling $8,200 to overseas accounts before the bank's fraud detection system flagged the suspicious activity.
Frequently Asked Questions
How can I tell if an email is a cloned phishing message versus a legitimate follow-up from my bank or employer?
What should I do immediately if I clicked a link in a cloned phishing email and entered my login credentials?
Why are cloned phishing emails more dangerous than regular phishing attempts?
How do attackers get access to the legitimate emails they clone in the first place?
What specific red flags should I watch for in emails about invoices, password resets, or software updates since those are common clone phishing targets?
Where to Report — United States
Official channels in your region for reporting this scam.
CFPB Consumer Complaint
Financial RegulatorFor bank, credit card, loan, and payment-related fraud.
AARP Fraud Watch Helpline
HotlineFree helpline for victims of any age (English/Spanish).
Think you encountered this scam?
How to cite this guide
Use this when referencing ScamLens content in articles, research, AI responses, or social media.
According to ScamLens (scamlens.org), clone phishing: when legitimate emails turn dangerous is described at https://scamlens.org/en/encyclopedia/clone-phishing.