Category hub: Social engineering and human risk

In one sentence: Whaling is a scam aimed at the most senior people in a business, such as the managing director or finance director, because their approval is worth the most to a criminal.

What is a whaling attack?

Whaling is spear phishing pointed at a “big fish”. The attacker writes a convincing, personal message to someone who can authorise payments, see sensitive data or reset systems.

Two things are often mixed up. In whaling, the executive is the target. In “CEO fraud”, the attacker pretends to be the executive and targets someone junior, such as an accounts clerk. Both rely on authority and urgency, and both often end in a payment. Sources use the terms slightly differently.

How it works

1. The attacker finds out who holds authority. Public sources can show who signs off payments.
2. They study the target’s role, suppliers and current projects. The NCSC notes attackers use your digital footprint to make messages convincing.
3. They send a message that fits a real situation, such as a confidential deal or a legal matter, and ask for speed and secrecy.
4. The victim pays, shares data or signs in on a fake page.

Who it affects and how badly

Any organisation with a clear chain of command can be affected.

• Sole trader to 10 staff: the owner is the whole target. One fake “urgent supplier” email can empty an account.
• 10 to 50 and 50 to 250 staff (construction, manufacturing, recruitment, estate agents): a director’s approval of a large transfer may be accepted without a second check.
• 250 plus and regulated firms: a compromised executive mailbox can expose board papers and client data. That can mean ICO notification, regulator attention and lost clients.

Real examples

• FACC (Austria, aerospace parts). FACC refers on its own site to a “Fake President Incident” at the end of 2015, in which around EUR 10.8 million was frozen in Chinese accounts and returned to the company in March 2025: FACC statement. SecurityWeek reported the firm said the scam cost it 41.9 million euros in its 2015/16 business year: SecurityWeek. This was a fake-president (impersonation) fraud, so it sits between whaling and CEO fraud.

How to detect it

• Treat any urgent, secret or unusual payment request from a senior person as suspect until confirmed.
• In Microsoft 365, review sign-ins for senior accounts in the Entra sign-in logs and check for new inbox rules or external forwarding.
• Look at the sender’s real address and the reply-to address, not only the display name.

How to fix or prevent it

1. Require a call-back on a known number for any new payee or bank-detail change, whoever asks.
2. Require two people to approve payments above a set limit, including directors.
3. Use phishing-resistant multi-factor authentication on executive and finance accounts.
4. Publish SPF, DKIM and DMARC for your domain.
5. Limit how much your website and social media say about who approves what.
6. Include executives in phishing simulations. The NCSC advises not to blame people who report.

Related terms

• spear-phishing
• business-email-compromise
• ceo-fraud
• phishing-resistant-mfa
• phishing-simulation
• invoice-fraud

Frequently asked questions

What is whaling?
Whaling, also called whale phishing or executive phishing, is phishing aimed at senior people in an organisation.

How is whaling different from spear phishing?
Whaling is spear phishing pointed at a big fish, so the executive is the target. In CEO fraud the attacker pretends to be the executive and targets someone junior. Both rely on authority and urgency.

How can I reduce the risk of whaling?
Use phishing-resistant sign-in for directors, confirm payment requests by phone on a known number and run realistic simulations for senior staff.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.

Service page: Phishy phishing simulation.