WhalingEven CEOs Can Be the Target of Fraudsters

What Is a Whaling Attack, and How Can I Stop One?

Imagine this: you’re a billing manager at a Fortune 500 company. You’re sitting at your desk,  when you receive an email. It requests that you send $5,000 to cover an invoice for a company you’ve never heard of. You sigh: another fraud attempt.

You forward the message to IT, delete from your account, and get on with your day. But, what if instead, that email came from someone you knew? Say, from a respected board member?

You get an email from your CEO that says “I’m flying to Bangkok right now for an important meeting. I need access to the vendor’s account file, but I forgot the password. Can you shoot that to me?” Would you be so quick to dismiss it? Fraudsters are betting you wouldn’t.

This could be an example of “whaling,” a specific phishing tactic. Even one attack could be a huge headache for your organization. In this post, we explain how whaling works, why it’s so effective, and red flags you should watch for.

What is Whaling?

Whaling

[noun]/wāl • iNG/

Whaling is a fraud tactic that involves a criminal impersonating a trusted source to exploit a top executive; one with access to funds or confidential data. The aim is to trick an executive into misusing company funds or giving up sensitive information.

“Whaling,” sometimes called whale phishing or CEO fraud, is a subset of phishing. It’s an increasingly common scam that targets senior executives — or “whales” — who can access private data like financial accounts, confidential information, or trade secrets. The fraudster requests funds or data by posing as someone the executive trusts. 

Whaling is similar to business email compromise (BEC) fraud, in that both involve theft through impersonation. What makes whaling unique is that the scam isn’t attempted on several persons at once. Rather, each attack is tailored to a specific person who can provide whatever the fraudster is phishing for. 

The other difference with whaling is that the crook typically poses as someone the target knows personally. In fact, scammers often spend extended periods becoming familiar with their victim and solidifying their deception. Only when that trust is established will the crook make their move.

How do Whaling Attacks Work?

Whaling attacks unfold through a deliberate, methodical process that can span weeks (or even months). Understanding this timeline helps explain why these scams succeed even against experienced executives.

Common Whaling Attack Vectors

Attackers choose their approach based on the target's habits and vulnerabilities. Understanding these vectors helps organizations strengthen defenses where they're most exposed.

How Big of a Threat is Whaling? 2024-2025 Statistics

Whaling attacks are growing more common and can cause major financial damage. At the same time, they’re often overlooked compared to other cybercrimes.

Whaling has been called a “silent but explosive” threat. Silent, because it doesn’t get the same level of press as high-profile attacks like ransomware. Explosive, because whaling losses can potentially be far more damaging than other fraud attacks.

Not convinced yet? Check out these numbers:

Whaling Examples: Case Studies of High-Profile Whaling Attacks

For the victim, the damage caused by such attacks can be catastrophic. Below, I’ve outlined a couple of high-profile whaling examples that should help illustrate what’s at stake here:

In one of the most sophisticated whaling attacks on record, cybercriminals targeted Arup, a multinational engineering firm, using deepfake video conference technology. I mentioned this briefly above, but it’s worth a deeper look.

A finance employee received what appeared to be a routine meeting invitation from the company’s CFO and other senior colleagues. During the video call, multiple executives — all AI-generated deepfakes — convinced the employee to authorize several wire transfers. The deepfakes were convincing enough to replicate facial expressions, speech patterns, and mannerisms with frightening accuracy. By the time the fraud was discovered, the company had lost $25 million.

This case marked a turning point in whaling attacks, demonstrating how artificial intelligence has elevated the threat beyond simple email spoofing to realistic, real-time impersonation that even trained employees struggle to detect.

Austrian aerospace parts manufacturer FACC fell victim to a whaling attack that cost the company approximately $47 million and resulted in significant leadership upheaval.

Cybercriminals impersonated the CEO in communications with the finance department, requesting funds for what was described as a confidential acquisition project. The request appeared legitimate: it came from the CEO’s email address, used appropriate business language, and referenced plausible company activities. The finance team, trusting the apparent source and the urgency conveyed, authorized the transfer to what turned out to be fraudulent accounts.

The financial loss was devastating, but the reputational damage proved equally severe. Both the CEO and CFO were terminated following the incident, highlighting how whaling attacks can permanently alter corporate leadership and damage stakeholder confidence.

Not all whaling attacks target money directly; some seek valuable data that can be exploited later. Snapchat’s payroll department received such an email that appeared to come from the company's CEO requesting employee payroll information.

The request seemed routine enough that the department complied without additional verification. The attacker successfully obtained sensitive data for numerous employees, including names, Social Security numbers, and wage information. While no direct financial theft occurred, the breach exposed employees to identity theft risks and created significant legal and compliance headaches for the company.

This incident demonstrates how whaling attacks can target HR and payroll departments, exploiting the fact that these teams regularly handle sensitive employee information and may be more accustomed to executive requests.

Networking technology company Ubiquiti Networks lost $46.7 million in a carefully orchestrated whaling attack involving fraudulent wire transfers.

Cybercriminals impersonated company executives in communications with the finance department over an extended period, building trust through seemingly legitimate correspondence. The attackers demonstrated detailed knowledge of company operations, vendors, and financial procedures. This made the requests for wire transfers appear authentic.

Once the fraud was discovered, Ubiquiti was required to report the incident to the SEC in quarterly filings, triggering stock price impacts and investor concern. The company eventually recovered some of the stolen funds through legal action and cooperation with law enforcement. But, the incident served as a wake-up call for the technology sector about the sophistication of executive impersonation attacks.

Red Flags of a Potential Whaling Attack

The target of a whaling scam may be someone at the tip-top of the executive food chain. But, as companies flatten hierarchies, crooks may shift their attention to different (and newer) positions. That means all staff should be on the lookout for odd or unexpected messages, especially from someone they believe they’ve been associating with.

If you get an unusual text or email from anyone claiming to be connected to the company, look for these red flags before taking any action:

• The message includes a request relating to a subject the two of you have never spoken of.
• The subject is secretive, but for believable reasons (legal trouble, potential embarrassment, etc.).
• The request is urgent, often requiring immediate action.
• The request involves a large payout, wire transfers, changing bank details, or sensitive employee data.
• Everything seems believable, but the request still feels off.
• The request would require a deviation from your standard processes — such as skipping normal channels or intervening where you otherwise wouldn’t.

How to Identify Whaling Attempts

The lifecycle of a whaling attack is usually measured in weeks, or even months, depending on how long it takes for the crook to feel they’ve established sufficient trust. Then, they hit the victim with a request. 

The request will vary depending on the position of the executive. Below, I’ve outlined a few common requests targeted at individuals in key positions:

Specifics will vary. But, there are three key elements that will factor into every request:

• The message and its sender must feel legitimate
• There must be high-stakes involved
• The need is urgent

Now, in most cases, a phone call or simple email could completely unravel the scam. That’s why the potential consequences must be high enough that the whale is persuaded to act swiftly, without following usual verification procedures.

How to Prevent (& Respond to) Whaling Attacks

Can whaling attacks be prevented? It’s possible, in most cases.

Vigilance on the part of you and your top execs is the key to identifying attacks before they do damage. In addition to the red flags mentioned above, you’ll want to perform your own checks, like contacting alleged senders through a secondary, trusted channel before you act.

There are a few other precautions you can take to help safeguard your organization as a whole:

Email authentication solutions help detect spoofed emails. These tools can cross-reference email content and metadata patterns (attachments, links, return-paths, etc.) against user behavior and suspicious sources.

Require multi-party approvals for large fund transfers or sensitive data requests. Also, insist that everyone rigidly adhere to those protocols without exception (that means you, too).

Never change payment information or any other third-party vendor info without verifying with the vendor first. Any change to vendor payment info, for example, should trigger compliance checks and require confirmation from known contacts.

We say this a lot, but it can’t be overstated: your best protection against fraud is regular education for staff. Develop a culture where employees feel safe to confirm unusual requests, even from senior execs.

Incident Response Plan: What Do You Do If Attacked?

Regardless of your prevention precautions, fraudsters will never stop trying to get to you. And the sad truth is: sometimes they’ll succeed. An important part of managing this kind of fraud is having a response plan, and that plan needs to be in place before you receive the first attack.

If fraudsters make it through your defenses, your first step is to seal off any potential access point. The whaler might have slipped a trojan horse or other virus into your previous communications, giving them access to other accounts of systems. Let IT do whatever it takes to control the situation.

At the same time, you’ll need to notify your security, compliance, or fraud-response teams. If money was sent or requested, contact the bank immediately; it may not be too late to freeze accounts or recover funds.

You should coordinate with legal experts to understand your responsibility, particularly if any sensitive data was exposed. Work through HR to ensure that all passwords (especially employees’ email accounts) are changed, ideally following a different convention. 

Whaling: One of Many Fraud Threats

Whaling attacks can be far more costly than typical phishing fraud. They’re harder to identify and prevent, too, as they’re built on trust, not tech. While everyone needs to understand the threat, those in higher positions need to be especially aware: you’re the whale the fraudster is hunting.

Whaling prevention needs to be part of an overall risk management and fraud prevention plan. Among other things, this should include employee training, data security programs, and strong internal controls. It should also include chargeback management, to handle fraud that leaks through your defenses. We can help with that… contact us to learn more.

Next Chapter

Vishing

Read More