A whaling attack is a phishing attack aimed at a senior executive, or one that impersonates one, to trick someone into sending money, data or credentials. The fraud usually succeeds through trust and urgency, not technical tricks, so the strongest defenses are process controls: verify payment requests on a second channel, and limit what any one email can authorize.
How does it relate to business email compromise?
Whaling is the executive-focused end of a wider fraud the FBI calls business email compromise, or email account compromise. The FBI's Internet Crime Complaint Center describes it as a sophisticated scam that targets businesses and individuals who perform legitimate transfer-of-funds requests, frequently carried out when a subject compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers. It is not always about money: one variation compromises email accounts to request employees' personal information or tax forms.
CISA's guidance describes the broader family: phishing is a form of social engineering that uses email or malicious websites to solicit information by posing as a trustworthy organization.
How big is the problem?
The FBI's September 2019 public service announcement reported, from complaints to IC3 between June 2016 and July 2019, 166,349 domestic and international incidents and about $26.2 billion in exposed dollar losses. The alert's headline calls it the $26 billion scam. That is dated data from one source and covers all business email compromise, not whaling alone. Use it as an indication of scale, and check IC3's more recent reports for current figures.
What does a typical case look like?
The FBI describes a payroll variant: a company's human resources or payroll department receives spoofed emails that appear to be from employees asking to change their direct deposit account. In some cases, phishing emails with a spoofed login page for an email host arrive first, so that attackers can collect credentials and make later requests look legitimate. The same pattern applies at the top of the company, except the claimed sender is the CEO or finance chief and the request is a wire transfer.
A constructed example
A finance clerk receives an email that appears to come from the CEO, who is traveling. It asks for a confidential payment to a new supplier today and says not to call because the CEO is in meetings. The display name is right. The address differs by one letter. A policy requires any new payee or change to bank details to be confirmed by a call to a known number, with a second approver above a set amount. The clerk calls the CEO's mobile number from the directory. The CEO knows nothing about it. The payment never leaves.
What do the authorities recommend?
The FBI advises employees to use secondary channels or two-factor authentication to verify requests for changes in account information; to make sure the URL in an email is associated with the business it claims to be from and watch for hyperlinks with misspellings of the actual domain; to refrain from supplying login credentials or personal information in response to emails; to verify the sending address, especially on mobile devices, and enable viewing of full email extensions; and to keep software patched. CISA's small business guidance adds that phishing is the most cost effective route for attackers and that FIDO authentication is the widely available phishing resistant option.
How to check or apply this
- Require call back verification, to a number you already had, for new payees and any change of bank details.
- Set dual approval above a threshold, and make sure executives cannot bypass it by email.
- Enable MFA on all executive and finance mailboxes, and prefer FIDO security keys for those accounts.
- Mark external email visibly, and watch for lookalike domains of your own domain.
- Train finance, payroll and executive assistants on this pattern with examples, and run realistic exercises.
- Tell executives to limit public detail about travel and org charts when they can.
- Have a fast route to report a fraudulent transfer: your bank, then law enforcement, as soon as possible.
Quick check
Is whaling the same as spear phishing?
They overlap. Both target specific people. Whaling aims at senior executives, or impersonates them, and usually seeks large payments or sensitive data.
Does email filtering stop whaling?
Not reliably. These emails often contain no malware or bad link. The controls that hold up are process checks such as call back verification and dual approval.
Sources
- FBI IC3: Business Email Compromise, The $26 Billion Scam (PSA I-091019-PSA)
- CISA: Avoiding Social Engineering and Phishing Attacks
- CISA: Cyber Guidance for Small Businesses
Last reviewed: 18 October 2026.
