Whaling is fraud aimed at executives or other senior staff, using authority and urgency so a large payment or data release looks legitimate.
It is spear phishing aimed upward, and one approval can move a wire or a set of tax files.
How it works
The message or call leans on rank and a narrow time window, often with a demand for secrecy.
Assistants and finance partners sit on the path and need the same refusal habits as the executive.
A rule that no message can waive a second approval removes the power of a forged urgent order.
Verification uses a channel the organization already has, not the number inside the lure.
Concrete examples
- A chief executive appears to order a confidential wire just before a board meeting.
- A finance lead is asked for employee tax forms by someone pretending to be an executive.
- An assistant is told to buy gift cards and to keep the request secret from colleagues.
Protective measures
- Require a second approval for large payments that no executive can waive by message alone.
- Verify unusual orders on a channel you already use for that person.
- Train assistants and finance staff together on this executive lure.
- Treat a demand for secrecy as a warning sign, not as a reason to skip process.