Spear phishing has success in manipulating users confidential information for 3 reasons:
The source appears to the user to be known, trusted and one that the user has frequent correspondence with
The verbiage used in the subject reinforces the validity that the source is legitimate
The information requested seems to make reasonable sense to the user considering the 'source'
An example of spear phishing would be an e-mail that appears to come from a specified and known network or IT person within your company. It prompts you to login with your employee name and password. Upon doing so, a malware is downloaded. As once the perpetrator has the user name and password of that employee, he/she can then access great amounts of company data using that access or perform transactions.