Whaling
Whaling is spear phishing aimed at a senior target, such as a board member or executive with access to valuable assets. The message is tailored to one person and usually draws on researched detail about their role, contacts and current business.
Current as of · Editorial policy
How it works
The UK National Cyber Security Centre describes whaling as "a type of spear phishing that targets a 'big phish', such as a board member who has access to valuable assets." Spear phishing means the message is written for a specific recipient rather than sent to thousands.
A whaling message may pose as someone the target already trusts. It may ask the target to approve a payment, open a document or sign in to a page that captures credentials. The target is chosen for the access the role carries, and the message is built around that role.
Why executive data matters
Whaling succeeds on specifics. Attackers need to know who the target works with, what is happening at the company and how the target writes. NCSC advises organizations to consider what visitors to their website need to know, and what detail is unnecessary but could be useful for attackers. It also notes that partners, contractors and suppliers may give away information about the organization online.
Breach data adds another layer. An executive's personal email address, phone number or old password in a breach gives an attacker a channel that company filters do not watch. Executive personal accounts in breach data explains why those channels are targeted.
Reducing the risk
Give leadership targeted awareness training and a fast way to report suspicious messages. Use multi-factor authentication on every executive account, including personal ones. Have an assistant or chief of staff follow a verification routine for any request that involves money, credentials or sensitive documents. Limit published detail about calendars, travel and assistants. Check which executive records already appear in breach data: CEM finds the leadership team from a company name and ranks their exposed records, so the likely starting points are known. WebThreat's Information Removal specialists file the opt-outs and takedown requests that remove the published contact details attackers research, and verify each removal.
How it differs from related terms
Phishing is mass-market, spear phishing is aimed at an individual, and whaling is spear phishing aimed at the most senior people. CEO fraud reverses the direction: the fraudster poses as the executive to deceive staff. Both can belong to business email compromise campaigns. A whaling attack can also aim at data or access rather than a payment.
Frequently asked questions
Is whaling different from phishing?
Whaling is a targeted form of phishing. It is written for one senior person, using researched detail, rather than sent in bulk.
Who counts as a whale?
NCSC gives a board member with access to valuable assets as the example. In practice that includes executives and others with authority over money, data or systems.
Sources
- Phishing attacks: defending your organisation (NCSC guidance), UK National Cyber Security Centre, accessed
Related terms
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.