{"id":248423,"date":"2026-10-19T00:00:24","date_gmt":"2026-10-19T00:00:24","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/clone-phishing\/"},"modified":"2026-10-19T00:00:25","modified_gmt":"2026-10-19T00:00:25","slug":"clone-phishing","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/clone-phishing\/","title":{"rendered":"Clone Phishing: How the Attack Works and How to Stop It"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>Clone phishing is an attack in which a criminal copies a legitimate email you already received, swaps the link or attachment for a malicious one, and sends it again from a address that looks like the original sender\u2019s. The message often claims to be an \u201cupdated\u201d or \u201cre-sent\u201d version. Because you recognize the email, you lower your guard. This guide explains how the scam works, how to spot a clone, what to do if you clicked, and which defenses actually hold up.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Strengthen Your Defenses Against Phishing<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">Explore LogMeOnce resources on password management, multi-factor authentication, and identity security to help protect your accounts.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#What_clone_phishing_is_in_plain_terms\" >What clone phishing is, in plain terms<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Clone_phishing_versus_spear_phishing\" >Clone phishing versus spear phishing<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#How_a_clone_phishing_attack_unfolds\" >How a clone phishing attack unfolds<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#The_quiet_follow-up_hidden_mailbox_rules\" >The quiet follow-up: hidden mailbox rules<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Why_it_works_so_well\" >Why it works so well<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#How_big_is_the_problem\" >How big is the problem?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Real-world_scenarios\" >Real-world scenarios<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#How_to_spot_a_cloned_email\" >How to spot a cloned email<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Check_the_sender_then_check_it_again\" >Check the sender, then check it again<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Compare_against_the_original\" >Compare against the original<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Treat_%E2%80%9Cresend%E2%80%9D_and_%E2%80%9Cupdated%E2%80%9D_as_triggers_to_slow_down\" >Treat \u201cresend\u201d and \u201cupdated\u201d as triggers to slow down<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Watch_for_unexpected_attachments_and_sign-in_prompts\" >Watch for unexpected attachments and sign-in prompts<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Look_at_the_timing_and_the_ask\" >Look at the timing and the ask<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#What_to_do_if_you_clicked\" >What to do if you clicked<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Defenses_that_work_against_clone_phishing\" >Defenses that work against clone phishing<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#For_everyone\" >For everyone<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Choose_MFA_that_phishing_cannot_replay\" >Choose MFA that phishing cannot replay<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#For_organizations\" >For organizations<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Our_perspective_assume_someone_will_click\" >Our perspective: assume someone will click<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Where_LogMeOnce_fits\" >Where LogMeOnce fits<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Is_it_illegal\" >Is it illegal?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Can_an_email_be_cloned\" >Can an email be cloned?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#What_is_the_difference_between_clone_phishing_and_spear_phishing\" >What is the difference between clone phishing and spear phishing?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Is_phishing_someone_illegal\" >Is phishing someone illegal?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Can_someone_clone_my_phone_number\" >Can someone clone my phone number?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Does_MFA_stop_clone_phishing\" >Does MFA stop clone phishing?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"https:\/\/logmeonce.com\/resources\/clone-phishing\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Clone phishing reuses a real, earlier email. Only the links or attachments change, and the sender address is spoofed or lookalike.<\/li>\n<li>The \u201cresend\u201d or \u201cupdated version\u201d pretext is the tell. Treat any unexpected follow-up with a link or file as suspect, even when the content is familiar.<\/li>\n<li>Verify through a second channel: a phone number you already know, never one in the message.<\/li>\n<li>Phishing-resistant MFA (security keys, passkeys) and a password manager limit the damage when someone does click.<\/li>\n<li>If you clicked and entered credentials, change the password at once from a clean device, turn on MFA and report it.<\/li>\n<\/ul>\n<h2 id=\"what-clone-phishing-is-in-plain-terms\"><span class=\"ez-toc-section\" id=\"What_clone_phishing_is_in_plain_terms\"><\/span>What clone phishing is, in plain terms<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Most phishing is a cold approach: a stranger pretends to be your bank. Clone phishing is different because it starts from something real. The attacker obtains a genuine message, such as an invoice, a shared-document notice or a delivery confirmation. They rebuild it almost exactly, then replace the original links or attachments with malicious versions.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1792234890329_Four-stages-of-a-clone-phishing-attack.jpeg\" alt=\"Four stages of a clone phishing attack\" title=\"\"><\/p>\n<p>The U.S. National Institute of Standards and Technology describes it in its guidance on email security as <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-177r1.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">cloning an email from a legitimate sender that carried an attachment or link<\/a>, then resending it from a spoofed address that mimics the original sender. It is listed there as a variation of phishing, alongside whaling, which targets senior executives.<\/p>\n<p>The technique depends on familiarity. You already know the sender and the topic. The message arrives as a plausible second copy, and your brain fills in the trust.<\/p>\n<h3 id=\"clone-phishing-versus-spear-phishing\"><span class=\"ez-toc-section\" id=\"Clone_phishing_versus_spear_phishing\"><\/span>Clone phishing versus spear phishing<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>People confuse the two, and a clone can be both. The difference is in how the message is built.<\/p>\n<table>\n<thead>\n<tr>\n<th><\/th>\n<th>Clone phishing<\/th>\n<th>Spear phishing<\/th>\n<th>Generic phishing<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Starting point<\/td>\n<td>A real email you already received<\/td>\n<td>Research about you or your employer<\/td>\n<td>A template sent to many people<\/td>\n<\/tr>\n<tr>\n<td>Main trick<\/td>\n<td>\u201cHere is the corrected or updated version\u201d<\/td>\n<td>Personal details and role-specific requests<\/td>\n<td>Urgency and fear (account locked, payment failed)<\/td>\n<\/tr>\n<tr>\n<td>Targeting<\/td>\n<td>Broad or narrow<\/td>\n<td>Narrow<\/td>\n<td>Broad<\/td>\n<\/tr>\n<tr>\n<td>What changes<\/td>\n<td>Links or attachments only<\/td>\n<td>The whole message is written for you<\/td>\n<td>Everything is invented<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>When an attacker has already compromised a mailbox, they can clone messages from real threads and send them to the same contacts. That version is the hardest to catch because even the sender address can be genuine.<\/p>\n<h2 id=\"how-a-clone-phishing-attack-unfolds\"><span class=\"ez-toc-section\" id=\"How_a_clone_phishing_attack_unfolds\"><\/span>How a clone phishing attack unfolds<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The details vary, but most attacks follow the same arc.<\/p>\n<ol>\n<li><strong>Collect.<\/strong> The attacker gets a genuine message. Sources include a breached mailbox, a leaked thread, a public mailing list or a message sent to a lookalike address they control.<\/li>\n<li><strong>Copy.<\/strong> They reproduce the layout, signature, logos and wording. Often the text is identical to the original.<\/li>\n<li><strong>Swap.<\/strong> The legitimate link now points to a fake sign-in page, or the attachment carries malware. Fake sign-in pages are built to capture your username and password as you type them.<\/li>\n<li><strong>Resend.<\/strong> The message goes out with a short note, such as \u201cResending with the correct link\u201d or \u201cUpdated, please use this version.\u201d<\/li>\n<li><strong>Harvest.<\/strong> Stolen credentials are used to log in. If the account is email, the attacker may repeat the cycle against your contacts.<\/li>\n<\/ol>\n<h3 id=\"the-quiet-follow-up-hidden-mailbox-rules\"><span class=\"ez-toc-section\" id=\"The_quiet_follow-up_hidden_mailbox_rules\"><\/span>The quiet follow-up: hidden mailbox rules<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Once inside an email account, attackers commonly try not to be noticed. NIST\u2019s email guidance notes that compromised accounts are often set up with mailbox rules that <a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-177r1.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">delete key messages and forward copies to an attacker-controlled address<\/a>. The result: you never see the bounce, the reply or the security notice that would have tipped you off, and the attacker keeps reading your correspondence.<\/p>\n<p>If you have ever suspected a mailbox compromise, check the rules and forwarding settings in your email account. Anything you did not create should be removed.<\/p>\n<h2 id=\"why-it-works-so-well\"><span class=\"ez-toc-section\" id=\"Why_it_works_so_well\"><\/span>Why it works so well<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Three things make clones effective.<\/p>\n<ul>\n<li><strong>Context.<\/strong> The message matches a conversation or transaction you expect. There is no strange tone to notice.<\/li>\n<li><strong>Pretext of correction.<\/strong> Nobody is suspicious of a fix. \u201cWe sent the wrong link\u201d is a believable, even helpful, sentence.<\/li>\n<li><strong>Weak filtering.<\/strong> Basic spam filters look for known bad content. A clone built from a real email, or sent from a compromised legitimate account, can slip past signature-based checks. Authentication standards (covered below) close part of the gap, but not all of it.<\/li>\n<\/ul>\n<h3 id=\"how-big-is-the-problem\"><span class=\"ez-toc-section\" id=\"How_big_is_the_problem\"><\/span>How big is the problem?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Clone phishing is rarely counted as its own category, so no clean national figure exists for it. The wider picture is clear, though. The FBI\u2019s Internet Crime Complaint Center logged 191,561 phishing and spoofing complaints in its 2025 annual report. The <a href=\"https:\/\/www.ic3.gov\/AnnualReport\/Reports\/2024_IC3Report.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">2024 report<\/a> listed 193,407 in the same category. Phishing and spoofing sit among the most-reported crime types year after year.<\/p>\n<p>The business side matters too. The IC3 has warned that criminals use phishing kits built to <a href=\"https:\/\/www.ic3.gov\/PSA\/2020\/PSA200406\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">mimic cloud-based email services to carry out business email compromise<\/a>, a scam that costs organizations billions. Cloned messages about invoices and shared documents are a natural fit for that playbook.<\/p>\n<h2 id=\"real-world-scenarios\"><span class=\"ez-toc-section\" id=\"Real-world_scenarios\"><\/span>Real-world scenarios<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>These are illustrative patterns, not reports of specific incidents.<\/p>\n<p><strong>The re-sent invoice.<\/strong> A vendor sends your accounting team an invoice on Monday. On Wednesday a message with the same subject, signature and amount arrives: \u201cPlease disregard the previous email and pay using the updated link.\u201d The link opens a payment portal controlled by the attacker, or the attached PDF asks you to sign in to view it.<\/p>\n<p><strong>The shared document.<\/strong> A colleague shares a file and you open it. Later a duplicate notification arrives from a slightly different address: \u201cAccess expired, open the new link.\u201d It leads to a fake sign-in page that looks like your company\u2019s login.<\/p>\n<p><strong>The order confirmation.<\/strong> After a real online purchase, you get a second \u201cshipment update\u201d that mirrors the first receipt but links to a fake tracking page asking for card details.<\/p>\n<p><strong>The newsletter or account notice.<\/strong> A message you subscribed to is copied exactly, with the \u201cmanage account\u201d button redirected. It works because you have seen this email dozens of times.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1792234908222_Real-world-scenarios-overview-diagram.jpeg\" alt=\"Real-world scenarios \u2014 overview diagram\" title=\"\"><\/p>\n<h2 id=\"how-to-spot-a-cloned-email\"><span class=\"ez-toc-section\" id=\"How_to_spot_a_cloned_email\"><\/span>How to spot a cloned email<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>No single sign is decisive. Combine them.<\/p>\n<h3 id=\"check-the-sender-then-check-it-again\"><span class=\"ez-toc-section\" id=\"Check_the_sender_then_check_it_again\"><\/span>Check the sender, then check it again<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Expand the sender details instead of reading only the display name. Look for swapped letters, an added word or an unfamiliar domain ending. Remember that a compromised real account will pass this test, so it is only one layer.<\/p>\n<h3 id=\"compare-against-the-original\"><span class=\"ez-toc-section\" id=\"Compare_against_the_original\"><\/span>Compare against the original<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If the original is still in your inbox, open both. Look at where each link goes by hovering over it, without clicking. A second copy that points to a different destination than the first is a red flag.<\/p>\n<h3 id=\"treat-resend-and-updated-as-triggers-to-slow-down\"><span class=\"ez-toc-section\" id=\"Treat_%E2%80%9Cresend%E2%80%9D_and_%E2%80%9Cupdated%E2%80%9D_as_triggers_to_slow_down\"><\/span>Treat \u201cresend\u201d and \u201cupdated\u201d as triggers to slow down<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The pretext is the signature of this attack. Any message that repeats an earlier one and adds a new link or file deserves a check before you act.<\/p>\n<h3 id=\"watch-for-unexpected-attachments-and-sign-in-prompts\"><span class=\"ez-toc-section\" id=\"Watch_for_unexpected_attachments_and_sign-in_prompts\"><\/span>Watch for unexpected attachments and sign-in prompts<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A document that asks you to log in to read it, an unexpected macro-enabled file, or a link to a page asking for your password are all reasons to stop. Open the service by typing the address yourself or using a bookmark.<\/p>\n<h3 id=\"look-at-the-timing-and-the-ask\"><span class=\"ez-toc-section\" id=\"Look_at_the_timing_and_the_ask\"><\/span>Look at the timing and the ask<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A second email about something already completed, a changed payment destination, or pressure to act immediately all deserve a call. The FTC\u2019s consumer guidance lists the same basics: scammers use email or text to try to steal <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">passwords, account numbers or Social Security numbers<\/a>.<\/p>\n<h2 id=\"what-to-do-if-you-clicked\"><span class=\"ez-toc-section\" id=\"What_to_do_if_you_clicked\"><\/span>What to do if you clicked<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Speed matters more than certainty. Work through these steps in order.<\/p>\n<ol>\n<li><strong>Disconnect if you opened an attachment.<\/strong> Take the device off the network and run a full scan with your security software. If it is a work device, tell your IT team immediately.<\/li>\n<li><strong>Change the password from a different, clean device.<\/strong> Start with the account the message targeted, then your email. If you reuse that password anywhere, change those accounts as well. Our short piece on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/password-reuse-convenient-but-dangerous\" target=\"_blank\" rel=\"noopener\">why password reuse is dangerous<\/a> explains why one stolen password so often unlocks several accounts.<\/li>\n<li><strong>Turn on or strengthen multi-factor authentication.<\/strong> Prefer a method that cannot be typed into a fake page (see below).<\/li>\n<li><strong>Check your email settings.<\/strong> Look for forwarding addresses and filtering rules you did not create, and review recent sign-in activity.<\/li>\n<li><strong>Alert the real sender and your contacts.<\/strong> If your account sent clones, people who trust you will be targeted next. Use a phone call or another channel, not email.<\/li>\n<li><strong>If money moved,<\/strong> contact your bank right away and ask about recalling the payment. U.S. businesses can also file a complaint with the FBI\u2019s IC3.<\/li>\n<li><strong>Report the message.<\/strong> The FTC asks people to report phishing at <a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">ReportFraud.ftc.gov<\/a>. Also use the report-phishing button in your email app.<\/li>\n<li><strong>Watch for fallout.<\/strong> Stolen credentials can be sold or reused. Monitoring for exposure helps you act before an account is abused.<\/li>\n<\/ol>\n<p>If you suspect your phone number was targeted, such as your service suddenly dropping to emergency calls only, call your carrier from another phone. The FCC notes that a phone going dark can be the <a href=\"https:\/\/docs.fcc.gov\/public\/attachments\/FCC-23-95A1_Rcd.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">first sign of a SIM swap or port-out attack<\/a>, and its rules now require carriers to use secure authentication before processing those changes.<\/p>\n<h2 id=\"defenses-that-work-against-clone-phishing\"><span class=\"ez-toc-section\" id=\"Defenses_that_work_against_clone_phishing\"><\/span>Defenses that work against clone phishing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"for-everyone\"><span class=\"ez-toc-section\" id=\"For_everyone\"><\/span>For everyone<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>Verify out of band.<\/strong> The FBI and CISA advice on business email compromise stresses <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2022\/12\/16\/fbi-fda-oci-and-usda-release-joint-cybersecurity-advisory-regarding-business-email-compromise\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">confirming wire transfers and sensitive changes through a separate channel<\/a>, such as a known phone number, not one in the email.<\/li>\n<li><strong>Go to the source.<\/strong> Do not use links from a \u201cresent\u201d message. Type the address or use a saved bookmark.<\/li>\n<li><strong>Use unique passwords everywhere.<\/strong> If a fake page captures one, the damage stops at one account. Our guide on <a href=\"https:\/\/logmeonce.com\/blog\/consumer\/keep-password-safe\" target=\"_blank\" rel=\"noopener\">keeping your passwords safe<\/a> covers the habits that matter.<\/li>\n<li><strong>Keep devices and apps updated.<\/strong> Malicious attachments often rely on known flaws.<\/li>\n<\/ul>\n<h3 id=\"choose-mfa-that-phishing-cannot-replay\"><span class=\"ez-toc-section\" id=\"Choose_MFA_that_phishing_cannot_replay\"><\/span>Choose MFA that phishing cannot replay<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Not all multi-factor authentication is equal. A code sent by text or typed from an app can be captured by a fake page and used immediately by the attacker. NIST\u2019s guidance on phishing resistance explains that <a href=\"https:\/\/www.nist.gov\/blogs\/cybersecurity-insights\/phishing-resistance-protecting-keys-your-kingdom\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">phishing-resistant authenticators bind the login to a specific website<\/a>, so a credential handed to a fake site is useless anywhere else. Hardware security keys and FIDO-based passkeys are the main examples.<\/p>\n<p>CISA encourages organizations to move toward this approach and has published a <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">fact sheet on implementing phishing-resistant MFA<\/a>. If you cannot switch everything at once, start with email, banking, the password manager and admin accounts.<\/p>\n<h3 id=\"for-organizations\"><span class=\"ez-toc-section\" id=\"For_organizations\"><\/span>For organizations<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>Publish SPF, DKIM and DMARC.<\/strong> These authentication records let receiving servers reject mail that forges your domain. NIST\u2019s email guidance treats them as foundational, and a DMARC policy set to reject is the strongest setting. They protect others from clones of your messages, and when you enforce checks on inbound mail they help protect you. They do not stop a clone sent from a genuinely compromised account.<\/li>\n<li><strong>Require verification for payment changes.<\/strong> Any change to bank details or any wire request gets a call-back to a known number.<\/li>\n<li><strong>Restrict mailbox rules and external forwarding.<\/strong> Alert on new forwarding rules, since that is a favorite attacker move.<\/li>\n<li><strong>Train with realistic examples.<\/strong> Use cloned-email scenarios in simulations, not only obvious scams.<\/li>\n<li><strong>Secure mobile devices.<\/strong> Many clones are opened on phones, where it is harder to check a link. Our post on <a href=\"https:\/\/logmeonce.com\/blog\/business\/7-ways-to-boost-mobile-device-security-for-an-enterprise\" target=\"_blank\" rel=\"noopener\">boosting mobile device security for the enterprise<\/a> lists practical controls.<\/li>\n<li><strong>Make reporting easy and blame-free.<\/strong> The faster a click is reported, the smaller the damage.<\/li>\n<\/ul>\n<h2 id=\"our-perspective-assume-someone-will-click\"><span class=\"ez-toc-section\" id=\"Our_perspective_assume_someone_will_click\"><\/span>Our perspective: assume someone will click<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>We work with passwords and identities every day, and one pattern keeps repeating: awareness training reduces clicks, but it never takes them to zero. A cloned email is built to pass a careful reader, so a defense that relies on perfect attention will eventually fail.<\/p>\n<p>That is why we think about clone phishing as a credential problem more than an email problem. The attacker wants one thing from a fake page: a password someone will type. Three habits shrink that prize.<\/p>\n<ul>\n<li><strong>Never reuse passwords.<\/strong> A unique password turns a successful phish into a single reset instead of a chain of takeovers.<\/li>\n<li><strong>Let software handle logins.<\/strong> If your login manager only offers to fill a credential on the address where you saved it, a lookalike page is a visible warning rather than a silent trap. Typing a password by hand into a page that looks right is exactly what the attacker hopes for.<\/li>\n<li><strong>Move toward passwordless and phishing-resistant sign-in.<\/strong> If there is no password to type, there is nothing for the fake page to capture. This is why passwordless MFA is a core part of what we build.<\/li>\n<\/ul>\n<p>We also encourage people to watch for what happens after theft. Stolen credentials often surface on criminal marketplaces, and early notice gives you time to rotate them. That is the idea behind dark web monitoring.<\/p>\n<p>One last point for teams: write the verification rule down. \u201cWe never change payment details by email\u201d is a policy people can follow under pressure, and clone phishing counts on there being no such policy.<\/p>\n<blockquote>\n<p><em>\u2014 Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"where-logmeonce-fits\"><span class=\"ez-toc-section\" id=\"Where_LogMeOnce_fits\"><\/span>Where LogMeOnce fits<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>No product can read a cloned email for you, and we will not claim ours does. What we can do is reduce what a successful phish is worth: a password manager to keep every login unique, passwordless MFA to remove typed passwords, and monitoring that tells you when your details appear where they should not.<\/p>\n<p>For individuals, plans start with a free Premium tier at $0.00 per month, with paid personal options such as Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month, all listed on our <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">password manager page<\/a>. Dark Web Monitoring is $1.67 per month and Family Dark Web Monitoring is $3.34 per month on our <a href=\"https:\/\/logmeonce.com\/pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">pricing and comparison page<\/a>. You can also run a check with our <a href=\"https:\/\/logmeonce.com\/dark-web-scan-tool\" target=\"_blank\" rel=\"noopener\">dark web scan tool<\/a> to see whether your email appears in exposed data.<\/p>\n<p>For companies, Teams is $4.00 per month per user and Business is $7.99 per month per user. Enterprise plans are quoted separately. Details are on the <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business pricing and comparison page<\/a>.<\/p>\n<h2 id=\"is-it-illegal\"><span class=\"ez-toc-section\" id=\"Is_it_illegal\"><\/span>Is it illegal?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Yes, in the U.S. clone phishing involves several offenses. Impersonating a business or government agency to defraud people runs against the FTC Act\u2019s ban on unfair or deceptive practices, and the FTC has a <a href=\"https:\/\/www.ftc.gov\/system\/files\/ftc_gov\/pdf\/r207000_govt_biz_impersonation_rule.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">trade regulation rule on impersonation of government and businesses<\/a>. Spoofing caller ID with intent to defraud is a separate violation, which the FTC has enforced through its <a href=\"https:\/\/www.ftc.gov\/system\/files\/documents\/public_statements\/1530800\/smith_-_operation_call_it_quits_remarks_6-25-19.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">telemarketing enforcement work<\/a>. Fraud and computer-intrusion laws can also apply. Legal outcomes depend on the facts and the jurisdiction, so if you have lost money or data, report it to the authorities and consult a lawyer about your options.<\/p>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"can-an-email-be-cloned\"><span class=\"ez-toc-section\" id=\"Can_an_email_be_cloned\"><\/span>Can an email be cloned?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. Anyone who has a copy of an email can rebuild it, including the layout, text and signature, and change the links or attachments. The sender address can be spoofed or made to look nearly identical. If an attacker controls the real mailbox, the cloned message can come from the genuine address.<\/p>\n<h3 id=\"what-is-the-difference-between-clone-phishing-and-spear-phishing\"><span class=\"ez-toc-section\" id=\"What_is_the_difference_between_clone_phishing_and_spear_phishing\"><\/span>What is the difference between clone phishing and spear phishing?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Clone phishing copies an email you already received and alters the link or file. Spear phishing writes a new message tailored to a specific person or organization using researched details. The two can overlap, for example when an attacker clones a message from a thread with your own manager.<\/p>\n<h3 id=\"is-phishing-someone-illegal\"><span class=\"ez-toc-section\" id=\"Is_phishing_someone_illegal\"><\/span>Is phishing someone illegal?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. Phishing to obtain money or personal data is fraud, and impersonating a business or agency violates federal rules enforced by the FTC. Penalties depend on the case and the laws that apply. If you are a victim, report it to the FTC and, where money was lost, to the FBI\u2019s IC3.<\/p>\n<h3 id=\"can-someone-clone-my-phone-number\"><span class=\"ez-toc-section\" id=\"Can_someone_clone_my_phone_number\"><\/span>Can someone clone my phone number?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Criminals can take over a number through a SIM swap or port-out, which moves your number to a device they control. The FCC says a sudden loss of service is often the first sign, and it now requires carriers to use secure authentication before approving these changes. Contact your carrier from another phone right away and secure accounts that use text-message codes.<\/p>\n<h3 id=\"does-mfa-stop-clone-phishing\"><span class=\"ez-toc-section\" id=\"Does_MFA_stop_clone_phishing\"><\/span>Does MFA stop clone phishing?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It depends on the type. Codes that you type can be relayed by a fake page. Phishing-resistant methods such as security keys and passkeys tie the login to the real website, so a cloned page cannot reuse them.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-177r1.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">NIST SP 800-177r1, Trustworthy Email<\/a><\/li>\n<li><a href=\"https:\/\/www.ic3.gov\/AnnualReport\/Reports\/2024_IC3Report.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FBI IC3 2024 Annual Report<\/a><\/li>\n<li><a href=\"https:\/\/www.ic3.gov\/PSA\/2020\/PSA200406\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">IC3 PSA: Business email compromise through cloud-based email services<\/a><\/li>\n<li><a href=\"https:\/\/consumer.ftc.gov\/articles\/how-recognize-avoid-phishing-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FTC: How to recognize and avoid phishing scams<\/a><\/li>\n<li><a href=\"https:\/\/docs.fcc.gov\/public\/attachments\/FCC-23-95A1_Rcd.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FCC order on SIM swap and port-out fraud<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2022\/12\/16\/fbi-fda-oci-and-usda-release-joint-cybersecurity-advisory-regarding-business-email-compromise\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">CISA: FBI joint advisory on business email compromise<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/blogs\/cybersecurity-insights\/phishing-resistance-protecting-keys-your-kingdom\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">NIST: Phishing resistance, protecting the keys to your kingdom<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">CISA: Implementing phishing-resistant MFA<\/a><\/li>\n<li><a href=\"https:\/\/www.ftc.gov\/system\/files\/ftc_gov\/pdf\/r207000_govt_biz_impersonation_rule.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FTC trade regulation rule on impersonation of government and businesses<\/a><\/li>\n<li><a href=\"https:\/\/www.ftc.gov\/system\/files\/documents\/public_statements\/1530800\/smith_-_operation_call_it_quits_remarks_6-25-19.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FTC: Operation Call It Quits remarks<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Clone phishing copies a real email you already received and swaps in a malicious link. Learn how to spot it, what to do if you clicked, and how to defend.<\/p>\n","protected":false},"author":0,"featured_media":248425,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248423","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248423"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248423\/revisions"}],"predecessor-version":[{"id":248424,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248423\/revisions\/248424"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248425"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}