Whaling is spear phishing aimed at senior executives — the 'big fish'. Because leaders can authorise payments, access sensitive data and command deference, a successful impersonation of (or attack on) them is unusually valuable to attackers.

Why target executives specifically?

Executives sit at decision points where one approval can move large sums or release sensitive information, and staff are reluctant to question them. Their details are also often public, making convincing impersonation easier.

How do you protect executives?

Tighten verification for high-value requests regardless of who appears to make them, reduce executives' public attack surface, authenticate email to prevent spoofing, and monitor for lookalike domains and fake profiles impersonating leadership.

Whaling: phishing that targets the executives

Whaling is spear phishing that goes after the biggest targets: the executives. The logic is simple — the higher up the org chart, the more a single compromised or impersonated account can do. A convincing "message from the CEO" carries authority that few employees will challenge.

Why executives are prime targets

Authority — their requests are followed quickly and questioned rarely.
Access — to finance, strategy, legal and sensitive data.
Exposure — names, roles and events are often public, making impersonation easy to research.
Leverage — one approved wire or shared document can be enormously costly.

What a whaling attack looks like

It may be an email "from the CEO" to finance requesting an urgent, confidential transfer; a lookalike-domain message to a board member; or a fake executive profile on social media used to build rapport before an ask. The common thread is borrowed authority plus urgency.

Whaling weaponises hierarchy: the same request that would be questioned from a peer sails through when it appears to come from the top. Process has to override deference.

How to protect leadership

Make high-value requests verify-by-default — out-of-band confirmation for payments and data, no matter who seems to ask.
Authenticate email (SPF, DKIM, DMARC) so the executive's real domain can't be spoofed.
Reduce public exposure of travel, schedules and org details where possible.
Monitor for lookalike domains and fake profiles impersonating executives.

Phish Plug watches for lookalike domains and impersonation used in executive-targeted scams, and helps take down the fake pages and profiles behind them.

The takeaway

Whaling targets the people whose word moves money and whose authority stops questions. The defence is to make verification automatic for high-value actions, shrink executives' public footprint, and watch for the impersonation that makes a whaling lure believable.

Whaling: phishing that targets the executives

Why executives are prime targets

What a whaling attack looks like

How to protect leadership

The takeaway

Related articles

Clone phishing: when a real email comes back poisoned

QR code phishing (quishing): the scan-and-steal scam

Pharming: when the right address sends you to a fake site

Protect your brand from impersonation