Whaling

Whaling is spear phishing aimed at senior leaders, such as owners and executives, or at staff acting for them, to authorize payments or reveal sensitive information.

Whaling attacks target the big fish in an organization. Messages are carefully crafted and may involve legal matters, acquisitions, board business, tax issues or confidential deals. Attackers may also impersonate an executive to pressure the finance team into making an urgent, secret payment.

In small and mid-sized Alberta businesses, owners and executives often have broad authority, access to banking and limited time to scrutinize every email. Their names and roles are easy to find online. A single successful whaling attack can result in a large fraudulent transfer that is very difficult to recover.

Practical tip: make sure leaders follow the same security rules as everyone else, including multi-factor authentication and training. Establish a clear policy that urgent payment requests, even from the owner, must be verified by phone using a known number or confirmed in person. Make it clear that staff will never be penalized for double-checking a request from leadership.