Whaling
Updated
Whaling is spear phishing directed at senior leaders or other high-value decision-makers. The lure uses their authority, access, or responsibilities to pursue valuable information or actions. It differs from simply impersonating a chief executive: in whaling, the executive or similarly valuable person is the target.
What do I need to know about Whaling?
- Legal, board, acquisition, and financial topics can make an unexpected message feel role-appropriate.
- Assistants and delegates may be involved in the workflow and need the same verification route.
- Seniority should not create an exception to authentication, reporting, or payment controls.
- Protecting executives also means making secure workflows usable during travel and mobile work.
An illustrative example
A senior leader receives an urgent message about a confidential transaction that requests sign-in to an unfamiliar document site. Rather than forwarding the live link to an assistant for immediate action, the leader verifies the matter through the established legal or finance contact. The requested secrecy does not override the normal process.
Practical checks
- Identify sensitive executive workflows and agree on independent verification paths before an urgent request arrives.
- Apply strong authentication and carefully review delegated mailbox and application access.
- Exercise reporting and response scenarios that include executives, assistants, finance, and IT.
Five FAQs about Whaling
How does whaling differ from spear phishing?
Whaling is the subset aimed at especially valuable or senior targets. Spear phishing can target any selected person or team with useful access or responsibilities.
Is an email pretending to be the CEO always whaling?
No. If it targets an employee by impersonating the CEO, it may be executive impersonation or BEC. Whaling describes who is targeted, not just who is imitated.
Why might a well-written legal notice be suspicious?
Role-appropriate language can create credibility without establishing authenticity. Verify unexpected demands, destinations, and deadlines through trusted legal or business contacts.
Should executives have exceptions to security controls?
Exceptions should be justified and controlled, not based simply on seniority. Their access and authority often make consistent protections especially important.
How can assistants help prevent whaling?
Give them clear authority to pause unusual requests, known verification contacts, and a safe reporting process. They should not have to choose between following an urgent instruction and following security policy.
Sources and further reading
Canadian Centre for Cyber Security: Email security best practices · Canadian Anti-Fraud Centre: Spear phishing and payment fraud
Related terms
Spear Phishing · Business Email Compromise (BEC) · Invoice Fraud
