What is whaling?
Whaling is spear phishing aimed at senior executives, or sent in an executive’s name, to get a large payment approved or sensitive data released. The authority of the target, or of the person impersonated, is what makes it work.
How it works
A whaling attack might pose as a board member asking the CFO for an urgent, confidential wire, or as the CEO asking an assistant for the payroll file. Cloned voices now let attackers follow the email with a call.
Defenses include out-of-band verification for payment requests, tighter controls on executive accounts, and simulations designed for leadership.
Why it matters
Executives hold the most access and the authority to bypass process, so a single successful attack can be the most expensive one.
