In short
A whaling attack is a targeted phishing or fraud email aimed at, or impersonating, a senior executive such as a managing director or finance director. Attackers use research and urgency to request payments, data or credentials. Detection relies on VIP impersonation protection, display-name and lookalike-domain checks, and account takeover monitoring; prevention adds DMARC, strong sign-in and process controls.
Get a quote for email protection against whaling attacks
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is a whaling attack?
Whaling is spear phishing aimed at the "big fish" in an organisation. It works in two directions:
- Aimed at senior people: emails designed to get a director to approve a payment, sign in to a fake portal or open a document, because their access and authority are worth more
- Sent as senior people: emails that impersonate a director to instruct finance or assistants, often called CEO fraud and a common type of BEC attack
Whaling emails are usually short and well written, reference real people and events, and lean on authority and confidentiality to discourage the recipient from checking.
Why directors and finance teams are targeted
Criminals choose senior people and the staff around them for practical reasons:
- Authority: a director can approve a payment or instruct someone else to make one, and few staff feel comfortable questioning an urgent request from the top
- Access: senior mailboxes hold board papers, deal documents, salary data and correspondence with banks, advisers and investors
- Visibility: names, roles, biographies and sometimes travel plans are easy to find on company websites, filings, press coverage and social media
- Busy schedules: executives often read mail on phones between meetings, where display names are shown and full addresses are hidden
- Delegation: assistants and finance staff act on executives' behalf, so an attacker can target them with the executive's name rather than the executive directly
The same reasoning applies to anyone who can move money or release sensitive data, which is why finance, payroll and HR teams need the same protection as the board.
Whaling vs spear phishing vs phishing
The three overlap. The difference is mainly in who is targeted and how much research goes into the message.
| Phishing | Spear phishing | Whaling | |
|---|---|---|---|
| Target | Many people at once | A specific person or team | Directors, partners and senior finance staff, or people acting for them |
| Research | Little or none | Some, from public sources | Detailed: roles, relationships, deals, travel |
| Typical goal | Credentials or malware | Credentials, access or payment | Large payments, sensitive data, executive credentials |
| Typical content | Links and attachments | Links, attachments or requests | Often a plain request with no payload |
| Best technical controls | Filtering, link and attachment analysis | Plus impersonation and behavioural detection | Plus VIP impersonation protection and executive account monitoring |
For the broader controls, see phishing protection.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Whaling attack examples
These generic examples illustrate common patterns without naming real organisations:
- The confidential acquisition: the finance director receives an email from the chief executive's name, apparently sent from a phone while travelling, asking for a deposit to be paid to secure a confidential deal and not discussed with anyone else
- The legal notice: a managing director receives a message styled as a court, regulator or solicitor's letter, with a link to "view the documents" that leads to a fake sign-in page
- The board pack: a non-executive director receives a "board papers ready to sign" e-signature request that harvests credentials
- The compromised executive: an attacker who has taken over a director's mailbox emails the finance team from it, so every authentication check passes
- The assistant route: an executive assistant with delegated access is asked, in the director's name, to change a payment or send a document
How whaling attacks are detected
Detecting whaling means spotting that a message claiming to be from, or aimed at, a senior person is not what it seems:
- VIP impersonation protection: in Microsoft Defender for Office 365, add directors and key finance staff to the protected users list in your anti-phishing policy, protect your domains against impersonation and turn on mailbox intelligence; third-party products such as IRONSCALES and FortiMail Workspace Security describe VIP impersonation protection too
- Display-name checks: Gmail's setting to protect against spoofing of employee names flags mail using a name from your directory on an outside address
- Lookalike-domain detection: Defender domain impersonation protection, Gmail's similar-domain setting and third-party layers flag domains that resemble your own
- Behavioural analysis: API-based products learn how executives normally write and to whom, and flag first-time or unusual requests
- Executive account monitoring: alerts on unusual sign-ins, new inbox rules and forwarding on senior mailboxes, because a compromised director's account is the most convincing source of all; see email account takeover
Impersonation from a lookalike domain can pass SPF, DKIM and DMARC if the attacker has set them up, which is why impersonation checks are needed alongside authentication.
Is email protection against whaling attacks the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Whaling attack prevention
Prevention combines technical settings with a few firm rules for senior people and the staff who act for them:
- List directors, partners and senior finance staff in your impersonation protection policies, and review the list when people join or leave.
- Enforce DMARC on your domains so criminals cannot send as your exact addresses; see email authentication.
- Give executives and finance staff phishing-resistant sign-in methods, such as passkeys or FIDO2 security keys.
- Review delegated access to executive mailboxes and remove what is no longer needed.
- Agree a rule that payment instructions from senior people are confirmed through a second channel, whoever they appear to come from.
- Limit what is published about executives' travel, deals and organisation structure where it is not needed.
- Include senior people in awareness training, as they are the most targeted.
How we help
We can help you protect directors and finance teams on Microsoft 365 or Google Workspace. We can:
- Review your impersonation protection settings and the list of protected people
- Check DMARC on your domains and the sign-in methods used by senior accounts
- Trial an API-based product with VIP impersonation protection in monitoring mode, where the product supports it
- Recommend, license and deploy the option that fits, with package contents confirmed at quote
Ask us for a quote: Contact us about protecting your senior team from whaling attacks.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is a whaling attack?
A whaling attack is a highly targeted phishing or fraud email aimed at, or impersonating, a senior executive such as a managing director or finance director. The goal is usually a large payment, sensitive data or the executive's credentials.
What is the difference between whaling and spear phishing?
Spear phishing targets a specific person or team using some research. Whaling is spear phishing aimed at the most senior people, or impersonating them, with more detailed research and higher-value goals.
How can whaling attacks be detected?
Use VIP impersonation protection in Microsoft Defender for Office 365 or a third-party layer, Gmail's employee-name and similar-domain settings, behavioural analysis that flags unusual requests, and alerts on unusual sign-ins or inbox rules on executive mailboxes.
How do you prevent whaling attacks?
Protect named executives in impersonation policies, enforce DMARC, give senior staff phishing-resistant sign-in, review delegated mailbox access, and require payment instructions from senior names to be confirmed through a second channel.
Why are executives targeted by whaling?
Senior people can approve payments, access sensitive information and instruct others, and their names carry authority. A successful attack on, or as, an executive is worth more to a criminal than one on a junior account.
Still have a question about email protection against whaling attacks?
Ask us and a member of our team will reply by email.