Whaling phishing is a highly targeted cyberattack that impersonates senior executives, board members, or other high-value individuals within an organisation to deceive employees, partners, or financial institutions into transferring funds, disclosing credentials, or authorising fraudulent actions. Unlike generic phishing campaigns, whaling attacks invest weeks or months of reconnaissance into a single target and produce communications so contextually accurate that standard email filters will never catch them.
The financial stakes are not theoretical. The FBI Internet Crime Complaint Center (IC3) classifies Business Email Compromise consistently as one of the costliest cybercrime categories it tracks, with cumulative adjusted losses across BEC/EAC complaints running into the multi-billions of dollars. Whaling sits at the top of that attack chain because the targets control the accounts, approve the wires, and carry the authority to override normal controls under perceived time pressure.
This guide covers how whaling attacks are built from scratch, how deepfake technology has escalated the threat as of 2026, and what your organisation needs to do technically and operationally to stop them before the wire goes out.
Whaling vs Spear Phishing vs BEC: Getting the Definitions Right
These three terms are used interchangeably in the press and, often, in security team briefings, which creates confusion about what you are actually defending against.
Spear phishing is a targeted phishing attack aimed at a specific individual or group, using personalised information to increase credibility. The target could be anyone: a junior accountant, an IT admin, a customer service rep.
Whaling phishing is a subset of spear phishing where the target is specifically a senior executive, board member, C-suite officer, or similarly high-authority individual. The word whale reflects the size of the prize. The attacker is not going after the goldfish; they are going after whoever can authorise a seven-figure transfer without asking anyone for permission.
Business Email Compromise is the broader fraud category. BEC includes whaling, but also covers vendor impersonation, payroll fraud, and attorney impersonation. A whaling attack often feeds directly into a BEC outcome: the CEO inbox gets compromised or convincingly spoofed, and the resulting email instructs the CFO to initiate a wire to a new banking partner. The National Cyber Security Centre has published guidance specifically on CEO fraud as a BEC variant, acknowledging that the combination of authority, urgency, and secrecy in these emails is engineered to bypass human judgement.
If you are thinking about your threat and vulnerability management programme, whaling deserves its own threat category, not a footnote under generic phishing.
How a Whaling Attack Is Built: Recon, Pretext, and the Urgency Trap
Most whaling attacks follow a consistent construction pattern. Understanding it is the first step to recognising the signals before money leaves your accounts.
Stage 1: Open-Source Intelligence Gathering
Attackers spend weeks on LinkedIn, Companies House filings, press releases, annual reports, and conference speaker bios. They are building a dossier on your CEO or CFO: their communication style, their direct reports, their current strategic priorities, any recent acquisitions, and which law firms or banks the company uses. A press release announcing a merger is not just investor news; it is an attacker entry point. It names the deal, the parties involved, the approximate timeline, and the executives responsible. All of that becomes pretext.
Stage 2: Pretext Construction
The pretext is the cover story that makes the request plausible. In a mature whaling attack, the attacker does not ask for a wire transfer out of nowhere. They reference a real deal, a real counterparty, a real date. The email arrives from a domain visually close to the target real domain (a homoglyph attack, such as rn substituted for m in the company name) or from a lookalike domain registered days before the campaign. The body of the email mirrors the executive actual writing style, sometimes pulled directly from public speeches or press interviews.
Stage 3: The Urgency and Secrecy Levers
Almost every whaling email contains two pressure mechanisms. First, urgency: the deal closes today, the payment window is 90 minutes, the counterparty will walk if the wire is delayed. Second, secrecy: do not loop in procurement, this is under NDA; handle this directly, we cannot risk a leak. These two levers are not accidental. They are designed to prevent the one thing that would stop the fraud cold: the recipient picking up a phone and calling the executive to confirm.
The pattern documented consistently in NCSC advisories and IC3 annual reports is that whaling emails typically combine three elements: verified contextual detail, apparent senior authority, and explicit instruction to bypass normal process. Any communication that hits all three should trigger an automatic out-of-band check, regardless of how legitimate it appears on the surface.
Deepfake Escalation: Voice and Video Executive Fraud as of 2026
The whaling threat has shifted materially over the past two years. Attackers who previously relied on email alone are now supplementing written social engineering with synthetic voice and, increasingly, live video impersonation of executives.
A widely reported 2024 case involved a finance worker who transferred approximately 25 million USD after participating in a video call in which every other participant, including what appeared to be the company CFO, was a deepfake. This is not an isolated incident; it represents a method that scales as the underlying models become cheaper and faster to run.
As of 2026, real-time voice cloning requires a few minutes of training audio, which is available for most senior executives via earnings calls, investor day recordings, or conference presentations posted to YouTube. The cost to produce a convincing voice clone has dropped to near zero for motivated attackers with access to open-source tooling. A threat actor does not need specialised infrastructure to clone your CEO voice well enough to deceive a finance manager operating under time pressure.
The practical implication for your security posture is that speaking to the CEO on the phone no longer functions as reliable verification on its own. Out-of-band verification must use a channel and a contact number that is known to be authentic, not the number provided in the suspicious email or call, and ideally involving a pre-agreed code phrase for high-value transactions.
The Cybersecurity and Infrastructure Security Agency has flagged AI-enabled social engineering, including voice and video deepfakes, as an escalating threat vector requiring updated verification protocols across critical infrastructure and financial sectors.
Technical Controls That Actually Reduce Whaling Attack Surface
Technical controls will not stop a determined attacker who has compromised a legitimate email account, but they significantly raise the cost of spoofing and eliminate the majority of opportunistic campaigns.
DMARC Enforcement: Not Just Publication
DMARC, DKIM, and SPF are the three authentication layers that let receiving mail servers verify whether an email genuinely originates from the domain it claims. Most organisations have published SPF and DKIM records. The problem is that publishing a DMARC record at p=none (monitoring mode) provides zero protection; it only generates reports. DMARC is only effective when enforced at p=quarantine or p=reject.
From a whaling defence standpoint, your priority should be enforcing DMARC on your own sending domains so that spoofed versions of your executive emails fail authentication at recipient mail servers. Separately, configure your inbound mail gateway to reject or quarantine messages from external domains that your executives are most likely to be impersonated against: your primary banks, retained law firms, and active deal counterparties.
Lookalike Domain Monitoring
Register your primary domain variants yourself: common typos, homoglyphs, alternate TLDs. Monitor for newly registered domains that resemble your company name using commercial threat intelligence feeds or open-source DNS monitoring tools. Attackers often register lookalike domains two to four weeks before a campaign launches. Early detection gives you time to report, block, or pursue takedown before the domain is put to use against your people.
External Email Banners That Actually Get Noticed
Add a prominent external sender banner to all inbound email from outside your organisation, specifically on any message that displays an internal executive name but arrives from an external domain. The banner must be visually prominent, not a grey line of small text below the signature. It should state plainly that the email was sent from outside the organisation. Attackers who are spoofing your CEO name from an external domain will have that fact visible to the recipient before they read a single line of the pretext.
Process Controls: Where Most Whaling Defences Actually Break Down
Technical controls are table stakes. The attacks that succeed in 2025 and 2026 are not beating your DMARC; they are exploiting process gaps that no email filter can catch.
I have seen this pattern repeatedly in post-incident reviews: an organisation had correct DMARC enforcement, a clear external email banner, and security awareness training that explicitly covered CEO fraud. The wire still went out because the attacker had compromised a legitimate vendor email account, not a spoofed one. The email passed every technical check. The failure was process: no dual authorisation requirement for wire transfers above a certain threshold, and no requirement for voice confirmation using a pre-registered number before funds moved.
Out-of-Band Verification as a Non-Negotiable Gate
For any payment instruction, change of banking details, or sensitive data disclosure request that arrives by email, regardless of who it appears to come from, your financial and administrative staff need a mandatory verification step that uses a completely different channel. This means calling the requester on a number pulled from your internal directory, not replying to the email and not using a number the email provides. The verification step is non-waivable, even under time pressure, even when the request appears to come directly from the CEO.
This is the single control that most directly disrupts the urgency and secrecy mechanics of a whaling attack. An attacker cannot intercept a phone call to a number they did not provide.
Dual Authorisation for High-Value Transactions
No single individual should be able to initiate and approve a wire transfer above a defined threshold. Two people, independently, must authorise the payment. One of those people should be unreachable by the same attack vector as the first. If the attacker is impersonating the CEO via email, the second authoriser should not be someone who would also respond to a CEO email instruction without independent verification. The threshold should be set deliberately, reviewed annually, and applied without exceptions for urgency.
Pre-Agreed Code Phrases for Audio and Video Requests
Given the deepfake escalation, senior finance and operations staff should have pre-agreed code phrases with the executives whose payment instructions they are most likely to receive. The code phrase is established in person or via a known-secure channel, changed quarterly, and its absence from any voice or video communication is treated as a red flag that triggers the out-of-band verification protocol regardless of how convincing the audio or video appears.
Why Standard Executive Security Awareness Training Fails for Whaling
Security awareness training for executives faces a specific structural problem: the people most targeted by whaling are usually the people with the least time for training and the most confidence in their own judgement. A 20-minute annual phishing module designed for general staff will not change the behaviour of a CFO who has been making high-pressure decisions for two decades.
Effective executive training for whaling defence has three characteristics. First, it is scenario-based, not lecture-based. The executive works through a reconstructed whaling attempt, ideally modelled on a real attack against a company in their sector, and identifies what signals they would or would not have caught. Second, it is brief and repeated quarterly rather than comprehensive and annual. Short, high-relevance touchpoints outperform long infrequent sessions for sustained behaviour change. Third, it explicitly addresses the authority paradox: the more decision-making power someone holds, the more attackers exploit the deference their direct reports show them. Executives need to build personal verification habits rather than assuming their judgement is the last line of defence.
One underrated component of executive security programmes is reverse simulation: letting the executive observe, or participate in sending, a test whaling attempt to their own team and reviewing the response rate. When a CEO sees that a meaningful proportion of their finance staff would have actioned a spoofed email from their own address, the training conversation shifts from abstract policy to operational urgency.
If your existing programme addresses the full range of types of phishing, ensure whaling gets dedicated module time with executive-specific scenarios rather than being grouped with credential harvesting attacks targeting general staff. The threat model, the required controls, and the behaviour changes are materially different at the executive level.
What to Do When You Suspect an Active Whaling Attempt
Speed matters when you suspect an active whaling attempt, but accuracy matters equally. Acting on a false positive and blocking a legitimate payment creates its own operational damage, which sophisticated attackers occasionally exploit by generating deliberate confusion inside target organisations.
Your first move is to pause, not cancel. Do not authorise the payment, but do not immediately announce internally that you suspect fraud. Contact the purported requestor via a verified channel and ask a neutral, factual question: can you confirm the reference number for the transfer you mentioned? A legitimate requestor will have an answer. An attacker either will not, or will provide one that does not match your internal records.
If the request is confirmed fraudulent, your next priorities are preserving evidence, notifying your bank to attempt a recall if funds have already moved, and reporting to Action Fraud in the UK or the IC3 in the US. The time between discovery and bank notification is the critical variable in fund recovery. Banks can sometimes reverse or hold wire transfers within the first few hours, but that window closes quickly and recovery rates drop sharply once funds have been forwarded onward to secondary accounts.
Document everything the attacker used: full email headers, the sending domain, the body content, any phone numbers included in the message. This intelligence feeds directly back into your defensive controls and helps identify whether the attacker had access to internal information suggesting a prior compromise elsewhere in your environment or supply chain.
Frequently Asked Questions
What is whaling phishing?
Whaling phishing is a targeted cyberattack that impersonates senior executives or high-authority individuals to deceive employees into transferring funds, disclosing credentials, or bypassing security controls. It differs from general phishing by the depth of attacker reconnaissance involved, the specificity of targeting, and the authority level of both the impersonated party and the intended recipient of the malicious instruction.
What is the difference between whaling and spear phishing?
Spear phishing targets any specific individual using personalised information. Whaling is a subset of spear phishing where the target or the impersonated party is a senior executive, board member, or C-suite officer. Whaling attacks carry higher financial stakes, involve more elaborate pretexts, and typically aim to trigger large wire transfers or access to sensitive financial systems.
How do you prevent whaling attacks?
Prevention requires layered controls: enforce DMARC at reject or quarantine on your domains, deploy prominent external sender banners, require out-of-band voice verification for any payment instruction above a defined threshold, implement dual authorisation for high-value transactions, monitor for lookalike domains, and run quarterly scenario-based executive training using real-world attack examples from your sector.
Why do whaling attacks target executives?
Executives hold the authority to approve large transactions, override controls, and instruct staff to act without further approval. Attackers exploit that authority by impersonating or directly targeting them. Because executives can self-authorise actions that require multiple approvals for other staff, compromising or convincingly impersonating one executive is far more operationally valuable than targeting many lower-level employees.
