Whaling Attacks: Executive Phishing Defense

Whaling is spear phishing aimed at the biggest targets: C-suite executives, board members, and senior leaders whose authority can move money, release sensitive data, or override normal process. It overlaps heavily with business email compromise (BEC), because attackers either target executives directly or impersonate them to pressure staff. The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints and $3.05 billion in losses in 2025. It notes that voice cloning can be used to request wire payments, and businesses reported more than $30 million in 2025 losses to BEC scams involving AI.

Whaling works because executives have both the authority attackers need and communication habits that make impersonation easier. They receive many urgent requests, often communicate informally from mobile devices, and are used to making fast decisions.

How Whaling Differs from Standard Phishing

Dimension	Bulk Phishing	Spear Phishing	Whaling
Target	Large, untargeted lists	Specific individuals	C-suite and senior leaders, or staff who act on their instructions
Research depth	Minimal	Moderate	Extensive
Pretext quality	Generic	Personalized	Highly crafted, specific to the business context
Typical request	Click a link	Share data, open a file	Authorize a transfer, share strategic data

For a full comparison, see our spear vs bulk phishing guide.

Whaling Attack Anatomy

Phase 1: Target Research

Attackers build detailed executive profiles from:

LinkedIn (job title, connections, board memberships, recent activity)
Company filings, press releases, and earnings calls
Social media (travel, conference appearances, personal interests)
News coverage (mergers, partnerships, leadership changes)
Supplier relationships and active projects

Phase 2: Pretext Construction

The attacker crafts a scenario that fits the executive’s known activities:

“Following up on the acquisition discussion from yesterday’s board meeting”
“Urgent: Legal review needed for the [real vendor] contract before close of business”
“Confidential: Board compensation review, please wire the consultant’s retainer”

These pretexts work because they reference real business context and create urgency within the executive’s actual scope of authority.

Phase 3: Delivery

Whaling messages typically arrive via:

Email from a lookalike domain or a compromised legitimate account
Text messages claiming to be from the CEO to the CFO or an assistant
Voice calls and voicemails that use cloned voices
Compromised or impersonated accounts on collaboration and messaging apps

Government leaders face the same playbook. The FBI warned in May 2025 that, since April 2025, malicious actors had been impersonating senior US officials with text messages and AI-generated voice messages to target current and former officials and their contacts. A common next step was a malicious link sent “under the guise of transitioning to a separate messaging platform,” used to take over accounts. In December 2025, the FBI said the impersonation campaign was continuing.

Phase 4: Exploitation

The attacker asks for an action within the target’s authority:

Wire transfer authorization
Sharing sensitive documents (strategic plans, M&A details, employee data)
Changing payment instructions for a vendor
Providing credentials or a two-factor code for “time-sensitive system access”

Real-World Example: Arup (2024)

In February 2024, Hong Kong police described a case in which a finance worker at a multinational firm paid out about $25.6 million (HK$200 million) after a video conference. As CNN reported, the worker first suspected that a message purportedly from the company’s UK-based chief financial officer, which spoke of a secret transaction, was a phishing email. He put those doubts aside after a video call with people who looked and sounded like the CFO and other colleagues, all of whom turned out to be deepfake re-creations. The money went out in 15 transactions. In May 2024, the UK engineering firm Arup confirmed it was the victim, saying “fake voices and images were used” and that none of its internal systems were compromised.

The lesson is not only that deepfakes exist. The video call, which the employee treated as verification, was the attack. Verification has to happen through a channel the defender controls.

Executive Protection Program

Technical Controls

Phishing-resistant MFA: FIDO2 security keys or passkeys for all executive accounts and their assistants’ accounts. Unlike one-time codes, they cannot be read out to an impersonator or relayed through a phishing page.
DMARC at reject: stops attackers from sending mail that spoofs your exact domain, including executives’ addresses. It does not stop lookalike domains, display-name impersonation, or messages that claim to come from an executive’s personal account, so pair it with the controls below.
Executive mailbox monitoring: anomaly detection on executive accounts, with alerts for new forwarding rules and sign-ins from unfamiliar locations
Domain monitoring: alerts when lookalike domains using your company or executive names are registered
Mobile device management: secure the phones and tablets that carry executives’ email, messaging apps, and authenticators

Procedural Controls

Dual authorization for all wire transfers and payment instruction changes
Callback verification using pre-registered phone numbers for transactions above a set threshold
No email-only or chat-only approvals for high-value financial decisions
A mandatory pause before executing any unexpected, urgent financial request
No channel switching on request: never move a payment or credential conversation to a new app or personal account because the requester asks
Designated verification contacts for board members and external advisors

Awareness and Culture

Executive-specific phishing simulations using whaling scenarios, including for executive assistants
Regular threat briefings tailored to executive attack patterns
Travel security protocols, with heightened vigilance during conferences and overseas trips
Social media hygiene to limit the public information that feeds attacker research
An open reporting culture: executives must feel comfortable reporting that they almost fell for an attack

Defending Against AI-Enhanced Whaling

AI has removed many of the traditional tells. In a December 2024 alert, the FBI warned that criminals use generative AI to clone voices and to “generate videos for real time video chats with alleged company executives,” as well as law enforcement and other authority figures. Its May 2025 warning added that a cloned voice “can sound nearly identical” to the real person. See our AI-generated phishing detection guide for more.

Countermeasures, drawn largely from the FBI’s guidance:

Agree on a verification phrase for urgent requests between executives, their direct reports, and assistants. The FBI recommends a secret word or phrase for families, and the same idea works inside a company.
Do not treat a video or voice call as proof of identity. In the Arup case, the call is what overcame the employee’s suspicion.
Hang up and call back on a number from your own directory, never one supplied in the message
Never share a two-factor code with anyone by email, text, or messaging app, and don’t click links until the sender’s identity is independently confirmed
Require multi-person approval for high-value or unusual transfers, with at least one approver verifying out of band
Limit public audio and video of executives where practical; the FBI advises limiting online content of your image and voice

If an Executive Is Targeted

Preserve the messages and call logs, report internally right away, and check the targeted accounts for compromise. If money has moved, the FBI’s advice is that time is of the essence: contact your bank immediately to request a recall, and file a complaint at ic3.gov with full transaction details. NIST’s SP 800-61 Rev. 3 (April 2025) provides a framework for building the wider incident response process.

Key Takeaways

Whaling targets executives for their authority, or impersonates them to pressure the people who act on their instructions
Attacks rely on deep research into business context, which makes them highly credible
A single deepfake video conference cost Arup about $25.6 million in 2024
Dual authorization and callback verification through channels the defender controls are core procedural defenses
The FBI warns that AI-generated voices and real-time video can impersonate executives and officials; don’t accept a call as proof of identity
Executive protection programs must combine technical, procedural, and awareness measures

For the complete phishing defense framework, see our phishing recognition and reporting guide.