Whaling is a form of highly targeted phishing directed at senior executives, organisational leaders, high-value employees or other individuals whose accounts or decisions could provide significant access or financial value. The term uses the idea of targeting a particularly valuable individual rather than a broad population. Whaling may target chief executives, finance leaders, senior administrators, business owners or other people with authority over payments, sensitive information or strategic systems.
Like other targeted phishing, it relies on deception and contextual information, but the intended victim is selected because of their position or influence. A whaling message may request a confidential payment, urgent transfer, disclosure of sensitive material, credential use or approval of an important action. The attack does not necessarily require the executive's account to be technically privileged; authority itself can make the person an attractive target because employees may comply with their instructions without normal verification. Consequently, whaling can exploit organisational hierarchy as much as it exploits technology.
The preparation for whaling can involve extensive reconnaissance. Public information about an organisation can reveal executive names, roles, corporate events, acquisitions, suppliers, subsidiaries and financial activities. Business websites, public filings, professional profiles and published announcements can help attackers construct realistic scenarios. Attackers may also obtain information from earlier compromises or from other members of the organisation.
Timing can be important because a fraudulent request is more credible when it coincides with a genuine transaction, business trip, corporate event or organisational change. An attacker might impersonate an executive and instruct a finance employee to make a payment, or impersonate an external party in a transaction involving senior management. The target may be chosen because they have authority to initiate or approve a high-impact action. The effectiveness of whaling therefore depends not only on technical deception but on understanding how decisions are made inside the organisation.
A common whaling scenario involves business email compromise, where an attacker obtains or imitates an account associated with an executive or other trusted person. If the attacker controls a genuine account, messages can be sent from a legitimate address and may use existing correspondence as context. If only the display name is manipulated, the attacker may attempt to make the message appear genuine while relying on the recipient's familiarity with the executive.
Payment fraud can arise when an attacker requests a transfer, changes bank details or creates a false sense of urgency around a transaction. The financial control weakness is often the assumption that an instruction is valid because it appears to come from a senior person. Independent verification and separation of duties can substantially reduce this risk. A high-value transaction should not become automatically legitimate simply because a senior executive appears to request it through email or another communication channel.
Whaling can also target executives because their accounts may contain valuable information even when they do not possess direct technical administrator privileges. Executive mailboxes can contain contracts, acquisition information, financial discussions, legal communications, employee information and strategic plans. Compromise can therefore support espionage, fraud, further phishing and competitive intelligence collection. An attacker who gains access to an executive account may study communication patterns and relationships before attempting a high-impact action.
They may also use the account to target other employees, exploiting the credibility associated with senior leadership. This makes post-compromise activity particularly important. Security teams should monitor unusual login patterns, unexpected forwarding rules, suspicious application permissions, anomalous downloads and messages that differ from normal communication behaviour. Protecting senior accounts is therefore not merely a matter of protecting one individual's data; those accounts can function as trusted nodes within an organisation's social and operational structure.
Whaling differs from spear phishing primarily through the type and value of the intended target. A targeted attack against a specific employee because of their role is generally described as spear phishing, while an attack specifically focused on a senior or highly valuable decision-maker is commonly called whaling. The categories can overlap because a whaling attack is effectively a particularly high-value form of targeted phishing.
The terminology is useful for describing attacker intent and target selection rather than for identifying a completely different technical mechanism. A whaling message can use the same delivery methods, fraudulent websites, malicious documents and impersonation techniques found in other phishing campaigns. Consequently, organisations should avoid treating whaling as a completely separate technical threat requiring a unique defensive technology. The more useful distinction is operational: senior personnel may require stronger protections and more rigorous verification because the consequences of successful deception can be disproportionately high.
Defences against whaling should account for the authority and responsibilities of the intended targets. Senior personnel should use strong authentication, protected devices and well-managed accounts, while organisations should establish clear procedures for financial and sensitive requests. A finance employee should not be expected to determine solely from an email whether an executive genuinely authorised a major transfer. Instead, the process can require independent confirmation using a known contact route and appropriate approval controls.
Similarly, requests for confidential information should be subject to established handling requirements rather than bypassing controls because the request appears to originate from senior leadership. Email security, authentication monitoring, endpoint protection and anti-malware controls remain important, but procedural controls are particularly significant because many whaling attacks attempt to persuade legitimate employees to perform legitimate actions for fraudulent reasons.
Senior executives can be unusually exposed to public information because organisations often publish leadership names, responsibilities, biographies and contact details. This information is not inherently dangerous and often serves legitimate transparency and communication purposes, but attackers can combine it with other information to create credible narratives. Organisations should therefore avoid assuming that publicly available information is irrelevant to security. At the same time, excessive attempts to conceal ordinary corporate information can interfere with legitimate business operations.
The practical objective is to identify information that creates unnecessary operational risk, protect genuinely sensitive material and ensure that high-impact processes do not rely on secrecy. Executive assistants, finance staff, procurement teams and other employees who interact frequently with senior personnel can also be targeted because they can execute actions on behalf of leadership. Whaling defence must therefore extend beyond the executive to the surrounding workflow and people who have authority to act on executive instructions.
After suspected whaling, organisations should investigate both the communication and any resulting business activity. If a payment was made, financial institutions and internal finance teams may need to be contacted rapidly. If credentials were exposed, authentication controls and account sessions should be reviewed. If an executive mailbox was compromised, investigators should examine sent messages, mailbox rules, forwarding configurations, delegated access and unusual application authorisations. Other employees who received messages from the compromised account may need to be warned.
The organisation should then examine why the fraudulent request was accepted and whether process changes are necessary. A technically secure account can still be used successfully in a fraud if the surrounding business process allows one message to authorise a high-impact action. Whaling therefore demonstrates the importance of combining cybersecurity controls with financial controls, identity protection, communication verification and organisational governance.
