Whaling phishing is a highly targeted phishing attack aimed at one specific senior person — a CEO, CFO, board member or business owner — rather than a mass email to everyone. The attacker researches the target, impersonates a trusted counterpart such as a lawyer, auditor, supplier or fellow executive, and uses that credibility to extract a large payment or sensitive data in a single move. In 2026 it is the most expensive form of phishing a small business can face, because one successful whaling email can cost more than a year of every other attack combined.
Key takeaways
- Whaling targets individuals with payment or approval authority, using research and real details rather than volume and urgency.
- The classic forms are the CEO fraud payment request, the fake lawyer or auditor email, and the compromised-supplier invoice.
- ASD's ACSC logged business email compromise as 15% of business cybercrime reports in FY2024–25, and BEC losses routinely reach six figures per incident.
- Technical filters cannot stop a whaling email that comes from a real, legitimate account — verification processes catch it instead.
- Monthly training plus simulations teaches the verification habit before the real email arrives.
How a whaling attack actually unfolds
A whaling attack starts weeks before the email arrives. The attacker studies your leadership on LinkedIn and your website, notes who approves payments, reads news about acquisitions or audits, and often monitors the mailbox of a real supplier or employee they have already compromised. The email that finally lands is short, calm and specific — it references a genuine deal, uses the real names and the real language of your business, and asks for exactly one thing: a payment, a file, or an approval.
That specificity is why it works. Spam filters see a legitimate message from a legitimate account. The recipient sees a normal request from a person who outranks them. Nobody is warned by urgency red flags, because the best whaling emails deliberately do not use them.
Whaling vs spear phishing vs ordinary phishing
| Ordinary phishing | Spear phishing | Whaling | |
|---|---|---|---|
| Target | Anyone, in bulk | A role or team | A named senior individual |
| Research | None | Light | Weeks, using public sources and compromised mailboxes |
| Typical ask | Click a link, enter credentials | Credentials, small payment | Large transfer, sensitive file, approval |
| Detection | Filters catch most | Filters catch some | Filters catch almost none |
| Cost when it works | Modest per victim | Moderate | Often six figures |
The three whaling plays to train for
- CEO fraud. An email that appears to come from the owner or CEO asks finance to make a confidential, time-sensitive payment to a new account. The request often arrives when the executive is genuinely travelling, so "call to confirm" feels impossible — it is not.
- The fake professional. A "lawyer" or "auditor" supervising a real transaction instructs that funds be redirected or documents released, using genuine deal details harvested from a compromised mailbox.
- The hijacked supplier. A supplier you genuinely pay reports a "new banking details" — from their own compromised account. The invoice, the thread and the sender are all real; the account number is not.
The defences that work
Technology reduces the surface, but whaling is defeated by process and people:
- Dual approval for payments and account changes. No single person, however senior, moves money alone.
- Out-of-band verification. Any payment-detail change or unusual transfer request is confirmed by phone on a number already held — never a number or reply supplied in the email.
- Monthly executive-inclusive training. Whaling targets the top of the org chart; the CEO needs the same training as the accounts clerk.
- Simulations that mirror the plays. A monthly phishing simulation should include executive-style payment requests and supplier bank-change lures, with instant coaching for anyone who bites.
- MFA everywhere. It will not stop a well-written email, but it stops the account takeover that makes the next whaling email convincing.
Cyber Aware's security awareness training runs the monthly modules, phishing simulations test the verification habit under pressure, and human risk reporting shows leadership exactly where the residual risk sits — the same dashboard the CFO can read in two minutes.
FAQ
What is whaling phishing in simple terms? A targeted phishing attack on one senior person, built on research and impersonation, designed to extract a large payment or sensitive data in a single email.
Why is it called whaling? Because the targets are the "big fish": executives, owners and board members whose single approval can move large sums.
How is whaling different from normal phishing? Normal phishing is bulk and cheap, aiming at anyone. Whaling is researched and personal, aiming at a named senior individual, and usually carries no obvious red flags — which is why email filters rarely catch it.
Can email filters stop whaling attacks? Partially. Filters stop lookalike domains and malware, but a whaling email sent from a real, compromised or legitimate account looks authentic to every filter. Verification processes and trained people catch what filters cannot.
What should an employee do if they receive a suspicious payment request from the CEO? Do not reply to the email. Call the executive on the number you already have, or confirm in person. If the request cannot be verified immediately, delay the payment — a legitimate urgent request survives a five-minute phone call.
How do you train staff to resist whaling? Monthly short modules covering the three plays — CEO fraud, fake professionals, hijacked suppliers — plus simulations that rehearse the same lures, so the verify-by-phone habit exists before the real email arrives.
One last thing
The most dangerous whaling email is the one that arrives during your busiest week, from a real account, about a real deal, asking for a normal-sounding approval. The businesses that survive it did not have better filters — they had a rule that no payment or account change ever moves on an email alone.