What Is Clone Phishing? How the Copy-and-Resend Email Scam Works

Most phishing advice trains you to look for red flags: bad grammar, odd formatting, a sender you do not recognize. Clone phishing defeats that instinct on purpose. Instead of writing a fake message, the attacker copies a genuine one you already trusted, swaps the safe link for a dangerous one, and sends it back to you looking almost identical to the original. This guide explains exactly how clone phishing works, how it differs from the attacks it is often confused with, and the practical steps a business can take to stop it.

What’s in This Guide

How Clone Phishing Works

Clone phishing is a form of social engineering: it manipulates a person into acting against their own interest, using trust rather than technical exploits. What makes the clone variant distinct is where that trust comes from. The attacker does not invent a convincing message. They start with one that was already convincing because it was real.

The attack usually follows five steps:

1. Obtain a legitimate email. The attacker gets hold of a real message, often by compromising a mailbox, capturing a forwarded copy, or pulling one from data exposed in a breach.
2. Clone it. They duplicate the original almost perfectly: the same sender name, subject line, logos, signature, and body text.
3. Swap the payload. The one meaningful change is the dangerous one. A legitimate link is replaced with a malicious lookalike, or a safe attachment is swapped for a weaponized file.
4. Spoof the sender. The message is set up to appear to come from the original sender, sometimes from a near-identical address that is easy to overlook.
5. Resend with a pretext. It arrives with a believable reason to look again: “resending with the corrected file,” “updated invoice attached,” or “please re-verify your details.”

Think of it like receiving a second copy of a letter your bank already mailed you. It is on the same letterhead, in the same envelope, with the same wording you remember. The only difference is that the reply form inside now routes to a scammer’s address instead of the bank’s. Nothing looks off, which is exactly the point.

Source: NIST Computer Security Resource Center: Phishing | CISA: Recognize and Report Phishing

Clone Phishing vs. Spear Phishing

Clone phishing is most often confused with spear phishing, and the two do overlap. Both can be highly targeted, and a single attack can use techniques from each. The core difference is where the message comes from.

Spear phishing builds a custom message from scratch, using details researched about a specific person: their name, role, projects, or vendors. Clone phishing skips the writing and copies an email that genuinely existed, borrowing the credibility of the real thing rather than manufacturing it.

In practice, the labels matter less than the defense, which is largely the same for both: verify unexpected or unusual requests through a channel other than the email itself before you act.

Source: NIST Computer Security Resource Center: Phishing

Why Clone Phishing Matters for Your Business

Phishing is not a fringe threat. It is the single most-reported type of cybercrime, and clone phishing is one of its most effective forms precisely because it slips past the instincts that catch cruder attempts. The scale of the underlying problem is documented in the FBI’s most recent annual crime data.

For a small or midsize business, the danger of clone phishing is rarely the single click itself. It is what the click unlocks: stolen credentials that give an attacker access to a mailbox, which then becomes the launch point for the next clone sent to your staff, your clients, and your vendors. A compromised account is also the classic first move in Business Email Compromise, where a criminal quietly monitors real conversations and inserts a fraudulent payment request at exactly the right moment.

Source: FBI IC3: 2024 Internet Crime Report

Where Clone Phishing Shows Up

Clone phishing is a technique, not a single script, so it appears in whatever email traffic is routine enough not to raise suspicion. A few patterns come up repeatedly in business settings:

• The “resent” invoice or receipt. A copy of a real invoice you already received arrives again, framed as a correction, with the payment link or attachment swapped for a malicious one.
• The duplicated shared document. A cloned notification from a familiar file-sharing or collaboration service asks you to log in again to view a document, sending your credentials to a fake sign-in page.
• The updated delivery or account notice. A shipping update, password reset, or account alert you have genuinely seen before is copied and reissued with a dangerous link.
• Thread hijacking. After compromising one mailbox, the attacker replies inside a real, ongoing email thread with a cloned-style message, so the malicious link arrives in a conversation you already trust.

The common thread is familiarity. Each scenario imitates something so ordinary that stopping to scrutinize it feels unnecessary, which is the reaction the attacker is counting on.

Source: CISA: Recognize and Report Phishing

How to Spot and Stop Clone Phishing

Because clone phishing hides in normal-looking email, defense works best in two layers: habits that help people catch it, and technical controls that stop most of it before it ever reaches an inbox.

What people should watch for

• An unexpected duplicate. You already received, read, or acted on this message. Why is it back?
• A changed sender address. Inspect the full address, not just the display name. Attackers use lookalikes that swap or add a single character.
• Altered links or attachments. Hover over a link to preview the real destination before clicking, and be wary of a file type or name that differs from the original.
• Pressure and pretext. Words like “urgent,” “corrected,” “updated,” or “action required” that push you to move quickly are a prompt to slow down instead.
• The verify-first rule. For any unexpected request involving payment, credentials, or sensitive data, confirm it through a separate channel, such as a phone call to a known number, before acting.

What technical controls should be in place

Habits alone are not enough, because clone phishing is designed to bypass human judgment. The reliable defense is a stack of controls that reduce how many malicious messages arrive and limit the damage when someone does slip:

• Email authentication (SPF, DKIM, and DMARC) to make it far harder for attackers to spoof your domain and to filter out messages that fail those checks.
• Advanced email filtering that inspects links and attachments and flags messages that duplicate prior threads or point to newly created lookalike domains.
• Multi-factor authentication on every account, so a stolen password alone is not enough to take over a mailbox.
• Regular, realistic security awareness training so staff recognize the contextual tells, reinforced with simulated phishing that reflects tactics like cloning.

Setting these up once is straightforward. Keeping them correctly configured, current, and consistent across every mailbox as your team and tools change is the hard part, and it is where gaps quietly open. That ongoing discipline is exactly what managed email security and a well-run security program provide. A Virtual CIO can build phishing defense and staff training into a broader security strategy rather than leaving it to chance.

Get email security managed across your business

Related Terms

Frequently Asked Questions

Build phishing defense into your security strategy

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC