What is
whaling?

Before a single message is sent, attackers research your business. They study your website, comb through LinkedIn, and scroll your social media to learn who's in charge, who handles the money, who's away travelling, and how your people talk to each other. Armed with that, they take one of two routes: they either target an executive directly — trying to hook the leader themselves — or they impersonate one to pressure a subordinate, most often someone in finance who's used to acting on the boss's word.

The usual ask is designed to move value fast: an urgent payment, a change of bank details on a legitimate supplier, a quick run of gift cards, or a slice of confidential information they can use in the next attack. Because it looks like it came from a person you trust, it sails past the usual caution.

• ▸ Urgency paired with secrecy — "don't discuss this with anyone yet." Real leaders rarely ask you to keep a payment quiet.
• ▸ "I'm unavailable, just email me" — a convenient reason you can't pick up the phone and check.
• ▸ New or changed bank details on an invoice or supplier — the classic move behind most losses.
• ▸ A request that skips the normal process — bypassing approvals, sign-offs or your usual steps.
• ▸ An email address that's subtly wrong — a swapped letter, an extra word, or a reply-to that doesn't match.

Senior people are worth the extra effort for three reasons. They have more authority and access — they can approve payments and reach sensitive information. They're publicly known, so their name, title and role are easy to find and easy to imitate. And crucially, staff are reluctant to question or slow down a request from the boss — nobody wants to be the person who held up something the CEO said was urgent. Attackers know that hesitation, and they lean on it hard.

1. Verify out-of-bandBefore acting on any money or data request, call the person on a number you already have — never a number from the email. A 30-second phone call defeats almost every whaling attempt.
2. Build a second-check into paymentsHave a payment and bank-change process that always requires an independent second person to confirm — especially for new accounts or changed details. Make it the rule, not the exception.
3. Brief your leaders and finance teamWalk your executives and finance staff through exactly this scam, using real examples. When people have seen the trick before, they spot it in the moment.
4. Add technical protectionsLayer on email filtering, impersonation protection, and "external sender" banners so lookalike and spoofed messages are flagged before anyone acts on them.