Whaling is a form of spear phishing directed at senior leaders, such as chief executives, finance directors or board members. The attacker researches the target and crafts a believable message, often about legal matters, payments or confidential deals.
Why it matters
Executives hold authority over money, data and staff, so one successful deception can have a large impact. Whaling messages often imitate a trusted partner, a lawyer or the executive's own team and request an urgent transfer or sensitive file. Public details, such as speaking events and press releases, make research easy.
Example
A finance manager receives an email that appears to come from the chief executive, who is travelling, asking for a confidential, urgent payment to a new supplier. A required policy says payments above a set limit need a second approver and a call to a known number. Following the policy exposes the fraud before any money moves.
Common mistakes
- Skipping verification because the request appears to come from someone senior.
- Letting executives bypass security controls for convenience.
- Treating training as relevant only to junior staff.
- Overlooking look-alike domains that differ by one character.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.