What is whaling phishing?
Definition
Whaling is a phishing attack aimed at senior executives or other high-ranking people, using a message that looks like it comes from a trusted source to steal information or get money moved.
- Category
- Scams
- Also called
- whaling, whale phishing, whaling attack, CEO fraud
- Last updated
Phishing, in NIST's words, is tricking individuals into disclosing sensitive personal information through deceptive computer-based means, by posing as a legitimate business or reputable person. Whaling is the same trick pointed at a bigger target. The UK's National Cyber Security Centre describes it as a highly targeted phishing attack, disguised as a legitimate email, aimed at senior executives.
Why executives
A CEO, finance director or board member can approve payments, sign off on changes and open doors that a junior employee can't. One convincing message to the right person is worth more to a scammer than thousands of generic ones. Because the target is chosen, the message is usually written for them: their name, their role, a project or supplier they really deal with.
A typical case
The finance director gets an email that looks like it's from the CEO, who is travelling: "I need a confidential payment sent to a new supplier today, I'll explain later." The tone is right, the request is urgent and secrecy is asked for. If the director replies and pays, the money goes to the scammer.
Whaling vs. phishing vs. spear phishing
- Phishing: a message sent to many people hoping some respond.
- Spear phishing: a message written for one person or a small group.
- Whaling: spear phishing where the target is a senior executive.
Why it matters if you're not an executive
Whaling messages are built from public details: job titles on company sites, press releases, social media posts and personal listings. Those same details can also be used to pose as the executive to the people around them. How much of that is easy to find about you is something you can reduce.
How to protect yourself
- 1
Confirm unusual payment or data requests another way
If a request to move money or share files comes by email, call the person on a number you already have. Don't use contact details from the message.
- 2
Slow down when a message demands urgency and secrecy
Pressure to act now and tell no one is the most common sign. Real executives can wait for a quick check.
- 3
Keep personal details off the public web
Remove home addresses, personal phone numbers and family details from people-search sites and public profiles, so there is less to build a convincing message from. Serus finds where your address and phone number are listed and removes them.
- 4
Use two-step verification on email and finance accounts
If a scammer does get your password, a second step can stop them signing in.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Why is it called whaling?
It is a play on phishing: the targets are the 'big fish', senior people with the authority to approve money or access.
What is the difference between spear phishing and whaling?
Both are targeted. Spear phishing can aim at anyone specific. Whaling is the version that aims at senior executives.
Can a regular person be whaled?
Not usually by name, but the same method is used against anyone who handles money or sensitive data. Treat any urgent, secret request as suspicious.
Sources
Something wrong or out of date? Tell us and we'll re-check it.