Whaling phishing: how scammers target executives and what it looks like
Quick answer
Whaling is phishing aimed at senior people, or sent in their name, to get a big payment or sensitive data. The tell is an urgent, secret request from the boss. Confirm it by phone using a number you already have before you pay or send anything.
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
- Comes by
- Email, Phone call
- First reported
- Latest official alert
- (FBI IC3)
- Last updated
How it works
Whaling is spear phishing (a phishing message written for one specific target) aimed at a company's top people, such as a CEO or an owner. It comes in two directions. Scammers email the executive to steal logins or approve something. Or they pretend to be the executive and email someone who can move money.
The FBI's Internet Crime Complaint Center (IC3) groups the second kind under business email compromise (BEC): criminals pose as a company leader, a vendor, HR staff or a law firm to get fraudulent wire transfers or payroll and W-2 data. In its 2018 alert the FBI said BEC had caused billions of dollars in fraud losses over the previous five years.
The usual script:
- Research. Scammers learn names, job titles and reporting lines from company pages, social media and bought contact details.
- The message. It looks like it comes from the executive, a lawyer or a vendor, often by spoofing the email domain or taking over a real mailbox.
- The push. The FBI notes they press the target to act quickly or secretly, often a wire transfer to an overseas account.
- The payoff. Money or payroll records, which can also be sold or used to file fraudulent tax returns.
If you're not an executive, this still matters. Your own name and email can end up in the research used to pretend to be your boss.
Sources checked: ic3.gov, consumer.ftc.gov
Last verified against the official page:
Red flags
- A request from the boss or a lawyer to pay or wire money urgently and keep it quiet
- An email from an outside address or a lookalike domain, showing a senior person's name
- New bank details for a vendor you already pay, sent by email
- Pressure to skip the usual approval, often near the end of the business day or week
- A request for payroll records, W-2 forms or gift cards
- The sender says they can't talk by phone right now
Example message
Are you at your desk? I'm in a meeting and can't call. I need a wire sent today for a confidential acquisition. Keep this between us, and I'll send the account details once you confirm. Reply here, not by phone, and click [link] to review the invoice.
What to do
- 1
Don't reply or click
Don't answer the message or open its attachments. Don't use any link or number in it.
- 2
Confirm by phone
Call the person at a number you already have, not one from the email. The FBI advises confirming payment and personnel-record requests by phone and requiring two people to approve transfers.
- 3
If you sent money, call your bank now
Ask for a wire recall. Speed matters, so do this before reporting. Then file a complaint at ic3.gov; the FBI asks victims to report whatever the amount or date.
- 4
If you shared logins or clicked
Change the password for that account and any other that uses it, and turn on multi-factor authentication. Scan with up-to-date security software. If personal data was exposed, go to identitytheft.gov.
- 5
Save the evidence
Keep the messages, email headers, payment details and any sending addresses for your bank and your report.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Whaling emails read as real because they use real names and job titles. That information comes from company websites, social media, data brokers and breaches. Serus finds where your personal details are listed on people-search sites and removes them, and alerts you when your email shows up in a breach, so there's less for a scammer to build a believable message from.
Official alerts
Frequently asked
What is the difference between whaling and spear phishing?
Spear phishing targets a specific person or group. Whaling is spear phishing aimed at senior executives, or sent as if from them to staff who can move money.
Is whaling the same as business email compromise?
They overlap. The FBI describes business email compromise as criminals posing as a company leader or employee to get fraudulent payments or payroll data. A whaling attack is often how it starts.
Can a normal employee be targeted?
Yes. Finance, payroll and assistants get the 'boss' email. The FBI lists HR staff, vendors and law firms as other identities scammers pose as.
How do I report a whaling attempt?
File at ic3.gov, even if you lost nothing. For a phishing email you can also report to the FTC at ReportFraud.ftc.gov, or send it to reportphishing@apwg.org.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
