Whaling Explained: A Cyberattack Targeting High-Profile Individuals

Bojan Jovanovic

Updated: July 14, 2023

SHARE:

We’ve all been contacted by a “Nigerian prince” or gotten a message from an unknown number/email claiming to be a relative or friend and asking for help due to being in a tight spot. Online scammers are everywhere, doing everything they can to get money and information fast. 

You might imagine a regular person falling for that kind of phishing attack, but what would it take to con a CEO?  The concept of conning a high-profile individual is called whaling. “What is whaling,” you might ask? We’ll be exploring it further in the article below.

What Is the Meaning of Whaling?

Catching the big fish is the dream most fishing enthusiasts share. Sometimes they just need the sustenance it provides, but mostly just to have a nice trophy. The online world is filled with nautical terminology, so let’s break it down one by one:

• Phishing

This type of cyber attack utilizes email, SMS (“smishing”), or any other direct messaging system to trick the target into sending money or confidential information. The key factor is that it does not target anyone specifically; the email is simply sent to several random recipients hoping that some of them will fall for the trick.

• Spear-phishing

With the tools being the same as in phishing, the key factor here is that the scammer will choose their targets based on a specific goal and plan accordingly.

• Whaling

Very similar to spear-phishing, it is a type of an online scam that specifically targets high-profile individuals in society or within a company. This is why it’s also known as executive phishing. Unlike CEO fraud, or BEC (Business Email Compromise) attacks (which it often gets confused with), whaling targets are specifically CEOs and other c-suite executives that can provide the big pay-off. 

With all of this in mind, it is also possible for a scammer to pull both kinds of attacks on the same company by first whaling the CEO for the money and the information they have and later using that same information to phish for funds from the lower-tier employees.

What Is the Point of Whaling and How Does It Work?

It’s quite simple, really. The scammer takes on the role of the whaler, usually impersonating an assistant in order to remind the CEO of some “missing payment” or a partner in the organization that is “missing some funds or information.” The point of whaling is to acquire resources or do corporate espionage, but it can also be inspired by a personal vendetta, desire for control, and many other motives. 

In these cyberattacks, victims may also be asked to click on a link sent to them through a whaling email (computer whaling) or an SMS that will lead them to a spoofed website that can steal data or infect the user’s device with malware.

Whalers will ask the target to share sensitive data such as payroll information, tax returns, or bank account numbers. Victims may also be asked to authorize a wire transfer to a bank account that turns out to be fraudulent. In order to leave a firmer impression of the email being legitimate, attackers sometimes also use a phone call along with it to reinforce the attack.

As such, many companies and CEOs have fallen victim to these cyberattacks. One such whaling example was an agricultural company called Scoular, when a whaler attack came through a chain of emails from one said company executive to another, costing the company $17 million.

Whaling and Phishing Signs

Now that we have whaling explained as a concept, how would you recognize an attack if you were the target? One of the key facts about wailing is that they all mostly have the same M.O. Once you know what to look for, it is relatively easy to recognize these scams:

• The email address might not match who the sender says they are. Check if there are any extra letters or numbers in the address or domain name that simply seem too much.
• Are there any spelling and formatting mistakes that you find unusual for the type of email you are expecting, or are some expressions used uncategorical for the sender? If so, it might be worth double-checking with the supposed sender through alternative means (asking them in person whether they really wrote the mail, for example).
• These types of emails always force a sense of urgency, so people tend to react to them in panic, which often leads them to not think straight. Once again, double-checking the facts might save you from being pulled into a fraud.

Security and Protection From Whaling

Research is fundamental in whaling. To “catch the whale,” scammers will often conduct thorough research and have elaborately devised plans in place. Having the correct information about the target will give them a sense of familiarity with the whaler, making them less cautious.

How to prevent that? In whaling, cyber awareness and security are crucial. Methods vary, but incorporating at least some, if not all, will make it significantly harder for scammers to succeed with their plans.

Employee Education

As high-profile individuals, top executive employees are often prime whaling targets. For the attack to be successful, the email must be convincing enough for the recipient to trust it. 

It can be much easier to go after the CEO through his or her close employees, like a personal assistant or a financial advisor, as they usually have the information the attackers need. Educating the employees about various types of attacks by showing them existing examples of whaling will allow them to recognize a suspicious email when they receive one and act accordingly. 

Social Media 

General information on high-profile individuals can usually be found online without much trouble. The more known a person is, the more the world will be interested in them. With that said, information visible on social media can be controlled to a certain extent.

Being careful about what is shared will save a person from spreading unnecessary information around, making it impossible to be used against them in any whaling/phishing attacks. If an assistant or a marketing manager is in charge of the social media for you or your company, it is of utmost importance that they are adequately informed about what is supposed to be published there. The same goes for the personal employee profiles, especially those of the key executives within a company.

Automated Solutions

Certain encryption software can help with recognizing phishing and whaling scams and attacks. Although no software is fully scam-proof because human error cannot be accounted for, it can be of immense help as an additional layer of security. Such tools include antivirus software, firewalls, ransomware protection, and anti-phishing programs. If you need help with encrypting your emails, make sure to check our guidelines for detailed information about the entire process.

Conclusion

Whaling and spear-phishing attacks can be notoriously difficult to deal with, and the damage they can inflict on a company’s finances and reputation is substantial. Combining and using every strategy we’ve mentioned against whaling and phishing attacks will make a company virtually unbreachable, no matter how devious the whaling or phishing attack is.