Clone Phishing: How the Attack Works and How to Stop It

Clone phishing is an attack in which a criminal copies a legitimate email you already received, swaps the link or attachment for a malicious one, and sends it again from a address that looks like the original sender’s. The message often claims to be an “updated” or “re-sent” version. Because you recognize the email, you lower your guard. This guide explains how the scam works, how to spot a clone, what to do if you clicked, and which defenses actually hold up.

TL;DR

• Clone phishing reuses a real, earlier email. Only the links or attachments change, and the sender address is spoofed or lookalike.
• The “resend” or “updated version” pretext is the tell. Treat any unexpected follow-up with a link or file as suspect, even when the content is familiar.
• Verify through a second channel: a phone number you already know, never one in the message.
• Phishing-resistant MFA (security keys, passkeys) and a password manager limit the damage when someone does click.
• If you clicked and entered credentials, change the password at once from a clean device, turn on MFA and report it.

What clone phishing is, in plain terms

Most phishing is a cold approach: a stranger pretends to be your bank. Clone phishing is different because it starts from something real. The attacker obtains a genuine message, such as an invoice, a shared-document notice or a delivery confirmation. They rebuild it almost exactly, then replace the original links or attachments with malicious versions.

The U.S. National Institute of Standards and Technology describes it in its guidance on email security as cloning an email from a legitimate sender that carried an attachment or link, then resending it from a spoofed address that mimics the original sender. It is listed there as a variation of phishing, alongside whaling, which targets senior executives.

The technique depends on familiarity. You already know the sender and the topic. The message arrives as a plausible second copy, and your brain fills in the trust.

Clone phishing versus spear phishing

People confuse the two, and a clone can be both. The difference is in how the message is built.

When an attacker has already compromised a mailbox, they can clone messages from real threads and send them to the same contacts. That version is the hardest to catch because even the sender address can be genuine.

How a clone phishing attack unfolds

The details vary, but most attacks follow the same arc.

1. Collect. The attacker gets a genuine message. Sources include a breached mailbox, a leaked thread, a public mailing list or a message sent to a lookalike address they control.
2. Copy. They reproduce the layout, signature, logos and wording. Often the text is identical to the original.
3. Swap. The legitimate link now points to a fake sign-in page, or the attachment carries malware. Fake sign-in pages are built to capture your username and password as you type them.
4. Resend. The message goes out with a short note, such as “Resending with the correct link” or “Updated, please use this version.”
5. Harvest. Stolen credentials are used to log in. If the account is email, the attacker may repeat the cycle against your contacts.

The quiet follow-up: hidden mailbox rules

Once inside an email account, attackers commonly try not to be noticed. NIST’s email guidance notes that compromised accounts are often set up with mailbox rules that delete key messages and forward copies to an attacker-controlled address. The result: you never see the bounce, the reply or the security notice that would have tipped you off, and the attacker keeps reading your correspondence.

If you have ever suspected a mailbox compromise, check the rules and forwarding settings in your email account. Anything you did not create should be removed.

Why it works so well

Three things make clones effective.

• Context. The message matches a conversation or transaction you expect. There is no strange tone to notice.
• Pretext of correction. Nobody is suspicious of a fix. “We sent the wrong link” is a believable, even helpful, sentence.
• Weak filtering. Basic spam filters look for known bad content. A clone built from a real email, or sent from a compromised legitimate account, can slip past signature-based checks. Authentication standards (covered below) close part of the gap, but not all of it.

How big is the problem?

Clone phishing is rarely counted as its own category, so no clean national figure exists for it. The wider picture is clear, though. The FBI’s Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints in its 2025 annual report. The 2024 report listed 193,407 in the same category. Phishing and spoofing sit among the most-reported crime types year after year.

The business side matters too. The IC3 has warned that criminals use phishing kits built to mimic cloud-based email services to carry out business email compromise, a scam that costs organizations billions. Cloned messages about invoices and shared documents are a natural fit for that playbook.

Real-world scenarios

These are illustrative patterns, not reports of specific incidents.

The re-sent invoice. A vendor sends your accounting team an invoice on Monday. On Wednesday a message with the same subject, signature and amount arrives: “Please disregard the previous email and pay using the updated link.” The link opens a payment portal controlled by the attacker, or the attached PDF asks you to sign in to view it.

The shared document. A colleague shares a file and you open it. Later a duplicate notification arrives from a slightly different address: “Access expired, open the new link.” It leads to a fake sign-in page that looks like your company’s login.

The order confirmation. After a real online purchase, you get a second “shipment update” that mirrors the first receipt but links to a fake tracking page asking for card details.

The newsletter or account notice. A message you subscribed to is copied exactly, with the “manage account” button redirected. It works because you have seen this email dozens of times.

How to spot a cloned email

No single sign is decisive. Combine them.

Check the sender, then check it again

Expand the sender details instead of reading only the display name. Look for swapped letters, an added word or an unfamiliar domain ending. Remember that a compromised real account will pass this test, so it is only one layer.

Compare against the original

If the original is still in your inbox, open both. Look at where each link goes by hovering over it, without clicking. A second copy that points to a different destination than the first is a red flag.

Treat “resend” and “updated” as triggers to slow down

The pretext is the signature of this attack. Any message that repeats an earlier one and adds a new link or file deserves a check before you act.

Watch for unexpected attachments and sign-in prompts

A document that asks you to log in to read it, an unexpected macro-enabled file, or a link to a page asking for your password are all reasons to stop. Open the service by typing the address yourself or using a bookmark.

Look at the timing and the ask

A second email about something already completed, a changed payment destination, or pressure to act immediately all deserve a call. The FTC’s consumer guidance lists the same basics: scammers use email or text to try to steal passwords, account numbers or Social Security numbers.

What to do if you clicked

Speed matters more than certainty. Work through these steps in order.

1. Disconnect if you opened an attachment. Take the device off the network and run a full scan with your security software. If it is a work device, tell your IT team immediately.
2. Change the password from a different, clean device. Start with the account the message targeted, then your email. If you reuse that password anywhere, change those accounts as well. Our short piece on why password reuse is dangerous explains why one stolen password so often unlocks several accounts.
3. Turn on or strengthen multi-factor authentication. Prefer a method that cannot be typed into a fake page (see below).
4. Check your email settings. Look for forwarding addresses and filtering rules you did not create, and review recent sign-in activity.
5. Alert the real sender and your contacts. If your account sent clones, people who trust you will be targeted next. Use a phone call or another channel, not email.
6. If money moved, contact your bank right away and ask about recalling the payment. U.S. businesses can also file a complaint with the FBI’s IC3.
7. Report the message. The FTC asks people to report phishing at ReportFraud.ftc.gov. Also use the report-phishing button in your email app.
8. Watch for fallout. Stolen credentials can be sold or reused. Monitoring for exposure helps you act before an account is abused.

If you suspect your phone number was targeted, such as your service suddenly dropping to emergency calls only, call your carrier from another phone. The FCC notes that a phone going dark can be the first sign of a SIM swap or port-out attack, and its rules now require carriers to use secure authentication before processing those changes.

Defenses that work against clone phishing

For everyone

• Verify out of band. The FBI and CISA advice on business email compromise stresses confirming wire transfers and sensitive changes through a separate channel, such as a known phone number, not one in the email.
• Go to the source. Do not use links from a “resent” message. Type the address or use a saved bookmark.
• Use unique passwords everywhere. If a fake page captures one, the damage stops at one account. Our guide on keeping your passwords safe covers the habits that matter.
• Keep devices and apps updated. Malicious attachments often rely on known flaws.

Choose MFA that phishing cannot replay

Not all multi-factor authentication is equal. A code sent by text or typed from an app can be captured by a fake page and used immediately by the attacker. NIST’s guidance on phishing resistance explains that phishing-resistant authenticators bind the login to a specific website, so a credential handed to a fake site is useless anywhere else. Hardware security keys and FIDO-based passkeys are the main examples.

CISA encourages organizations to move toward this approach and has published a fact sheet on implementing phishing-resistant MFA. If you cannot switch everything at once, start with email, banking, the password manager and admin accounts.

For organizations

• Publish SPF, DKIM and DMARC. These authentication records let receiving servers reject mail that forges your domain. NIST’s email guidance treats them as foundational, and a DMARC policy set to reject is the strongest setting. They protect others from clones of your messages, and when you enforce checks on inbound mail they help protect you. They do not stop a clone sent from a genuinely compromised account.
• Require verification for payment changes. Any change to bank details or any wire request gets a call-back to a known number.
• Restrict mailbox rules and external forwarding. Alert on new forwarding rules, since that is a favorite attacker move.
• Train with realistic examples. Use cloned-email scenarios in simulations, not only obvious scams.
• Secure mobile devices. Many clones are opened on phones, where it is harder to check a link. Our post on boosting mobile device security for the enterprise lists practical controls.
• Make reporting easy and blame-free. The faster a click is reported, the smaller the damage.

Our perspective: assume someone will click

We work with passwords and identities every day, and one pattern keeps repeating: awareness training reduces clicks, but it never takes them to zero. A cloned email is built to pass a careful reader, so a defense that relies on perfect attention will eventually fail.

That is why we think about clone phishing as a credential problem more than an email problem. The attacker wants one thing from a fake page: a password someone will type. Three habits shrink that prize.

• Never reuse passwords. A unique password turns a successful phish into a single reset instead of a chain of takeovers.
• Let software handle logins. If your login manager only offers to fill a credential on the address where you saved it, a lookalike page is a visible warning rather than a silent trap. Typing a password by hand into a page that looks right is exactly what the attacker hopes for.
• Move toward passwordless and phishing-resistant sign-in. If there is no password to type, there is nothing for the fake page to capture. This is why passwordless MFA is a core part of what we build.

We also encourage people to watch for what happens after theft. Stolen credentials often surface on criminal marketplaces, and early notice gives you time to rotate them. That is the idea behind dark web monitoring.

One last point for teams: write the verification rule down. “We never change payment details by email” is a policy people can follow under pressure, and clone phishing counts on there being no such policy.

— Mike

Where LogMeOnce fits

No product can read a cloned email for you, and we will not claim ours does. What we can do is reduce what a successful phish is worth: a password manager to keep every login unique, passwordless MFA to remove typed passwords, and monitoring that tells you when your details appear where they should not.

For individuals, plans start with a free Premium tier at $0.00 per month, with paid personal options such as Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month, all listed on our password manager page. Dark Web Monitoring is $1.67 per month and Family Dark Web Monitoring is $3.34 per month on our pricing and comparison page. You can also run a check with our dark web scan tool to see whether your email appears in exposed data.

For companies, Teams is $4.00 per month per user and Business is $7.99 per month per user. Enterprise plans are quoted separately. Details are on the business pricing and comparison page.

Is it illegal?

Yes, in the U.S. clone phishing involves several offenses. Impersonating a business or government agency to defraud people runs against the FTC Act’s ban on unfair or deceptive practices, and the FTC has a trade regulation rule on impersonation of government and businesses. Spoofing caller ID with intent to defraud is a separate violation, which the FTC has enforced through its telemarketing enforcement work. Fraud and computer-intrusion laws can also apply. Legal outcomes depend on the facts and the jurisdiction, so if you have lost money or data, report it to the authorities and consult a lawyer about your options.

FAQ

Can an email be cloned?

Yes. Anyone who has a copy of an email can rebuild it, including the layout, text and signature, and change the links or attachments. The sender address can be spoofed or made to look nearly identical. If an attacker controls the real mailbox, the cloned message can come from the genuine address.

What is the difference between clone phishing and spear phishing?

Clone phishing copies an email you already received and alters the link or file. Spear phishing writes a new message tailored to a specific person or organization using researched details. The two can overlap, for example when an attacker clones a message from a thread with your own manager.

Is phishing someone illegal?

Yes. Phishing to obtain money or personal data is fraud, and impersonating a business or agency violates federal rules enforced by the FTC. Penalties depend on the case and the laws that apply. If you are a victim, report it to the FTC and, where money was lost, to the FBI’s IC3.

Can someone clone my phone number?

Criminals can take over a number through a SIM swap or port-out, which moves your number to a device they control. The FCC says a sudden loss of service is often the first sign, and it now requires carriers to use secure authentication before approving these changes. Contact your carrier from another phone right away and secure accounts that use text-message codes.

Does MFA stop clone phishing?

It depends on the type. Codes that you type can be relayed by a fake page. Phishing-resistant methods such as security keys and passkeys tie the login to the real website, so a cloned page cannot reuse them.

Sources

• NIST SP 800-177r1, Trustworthy Email
• FBI IC3 2024 Annual Report
• IC3 PSA: Business email compromise through cloud-based email services
• FTC: How to recognize and avoid phishing scams
• FCC order on SIM swap and port-out fraud
• CISA: FBI joint advisory on business email compromise
• NIST: Phishing resistance, protecting the keys to your kingdom
• CISA: Implementing phishing-resistant MFA
• FTC trade regulation rule on impersonation of government and businesses
• FTC: Operation Call It Quits remarks