What Is Whaling? The CEO Fraud Emails That Target Executives Specifically

Your CFO gets an email. It looks like it's from the CEO. The writing style matches perfectly, the same casual sign-off, the same shorthand for internal projects, even a reference to the EA by her first name. The subject line references a real acquisition your company has been quietly working on for months. The request is urgent: a wire transfer needs to go out before end of business today to secure the deal. There's no time to loop in legal. Don't mention it to anyone else yet, the board hasn't been briefed.

Within hours, millions of dollars are gone. The real CEO never sent that email.

This is whaling, and it's not a hypothetical. It's happening to real companies, with real executives, right now, and the attacks are growing more convincing, more frequent, and more expensive every year.

What is a whaling attack?

A whaling attack is a highly targeted form of phishing aimed specifically at an organization's most senior people: CEOs, CFOs, board members, general counsels, and other high-authority executives. The name comes from the analogy: if regular phishing is dragging a wide net through the ocean hoping to catch anything that swims by, a whaling attack means going after the biggest fish, the ones whose decisions move money, data, and organizational power.

Unlike broad phishing campaigns that blast thousands of generic emails hoping someone clicks, whaling attacks are surgically precise. Attackers can spend weeks or months researching a single target before sending a single message. They study the executive's communication style by reviewing public interviews and earnings call transcripts. They map the org chart to understand who reports to whom and who controls financial approvals. They read LinkedIn announcements to learn about recent promotions, new hires, and strategic initiatives. They monitor press releases, regulatory filings, and social media to identify live business events (an acquisition, a restructuring, a new product launch) that can serve as convincing cover for a fraudulent request.

The result is an email (or sometimes a phone call, a text message, or even a video call) that is nearly indistinguishable from legitimate executive correspondence. There are no suspicious links, no obvious grammatical errors, no generic greetings. Just a message that looks, sounds, and feels exactly like something the real executive would send.

Whaling vs. spear phishing vs. CEO fraud: what's the difference?

These terms get used interchangeably in news coverage and security briefings, but they're not identical, and understanding the distinctions matters for building the right defenses.

TermWho is targetedWho is the victimPhishingAnyoneGeneral employees, consumersSpear PhishingSpecific individuals or departmentsMid-level employees, IT staffWhalingC-suite and senior executivesThe executive themselvesCEO FraudEmployees (impersonating the CEO)Finance/HR staff duped by a fake executive

Whaling and CEO fraud are often used as synonyms, but there's a meaningful operational distinction:

• In a whaling attack, the executive is the target, someone is trying to deceive the CEO or CFO directly, perhaps to extract login credentials, sensitive strategic information, or approval for a fraudulent transaction.
• In CEO fraud, the executive's identity is weaponized, attackers impersonate the CEO to manipulate subordinates into wiring money, changing payroll accounts, or handing over sensitive employee data.

In practice, these two approaches are often combined. An attacker might first compromise a CEO's email account through a whaling attack, then use that legitimate account to conduct CEO fraud against the finance team, making the fraud nearly impossible to detect through email inspection alone.

Both fall under the broader umbrella of Business Email Compromise (BEC), which the FBI defines as any fraud that exploits email communications to deceive organizations into financial transfers or data disclosures. BEC is now the single largest category of cybercrime by financial loss in the United States.

The numbers behind the threat

The financial damage from whaling and CEO fraud is staggering, and accelerating at a pace that outstrips most other categories of cybercrime.

• $3.05 billion in verified losses were attributed to business email compromise in 2025 alone, according to the FBI IC3 2025 Internet Crime Report, up from $2.77 billion in 2024, a roughly 10% year-over-year increase.
• BEC has cost businesses a cumulative more than $55 billion since 2013 (per the FBI's last full accounting, through 2023, with 2024 and 2025 losses adding billions more), making it one of the most financially destructive cybercrime categories ever tracked.
• Whaling attacks targeting senior executives averaged $137,000 in losses per incident in 2024, though individual cases frequently run into the tens of millions. (Vectra AI)
• 72% of organizations reported their senior executives had been targeted by a cyberattack at least once in the previous 18 months, according to GetApp's 2024 Executive Cybersecurity Survey, meaning the C-suite is not a peripheral target but the primary one.
• AI-enabled fraud is projected to reach $40 billion by 2027, per Deloitte's Center for Financial Services, with whaling playing a central role in that surge as generative AI makes it easier to craft convincing impersonations at scale. (Adaptive Security)

These aren't edge cases or cautionary tales from a handful of unlucky organizations. They represent the dominant financial cybercrime vector in the United States, and executives are the primary target precisely because their authority makes the fraud more convincing and the payouts larger.

How a whaling attack actually works

Understanding the mechanics helps organizations recognize and interrupt an attack in progress. Whaling attacks don't happen randomly, they follow a deliberate, multi-stage process that can span weeks before a single fraudulent message is sent.

1. Reconnaissance

The attacker builds a detailed profile of the target using entirely open-source information. They mine LinkedIn for the executive's career history, connections, and recent activity. They review corporate websites, press releases, and SEC filings for financial details and strategic priorities. They watch conference speaker bios and recorded presentations to study communication style and vocabulary. They identify the executive's EA, their direct reports, and who controls financial approvals, because the goal is often not to deceive the executive directly, but to use the executive's identity to deceive someone else.

2. Infrastructure setup

Attackers register lookalike domains built to pass a quick visual inspection, think ceo-name@companyname-inc.com instead of @companyname.com, or @cornpany.com with a lowercase "rn" replacing the "m." In more sophisticated attacks, they compromise a legitimate email account entirely, so the message originates from the real domain. They craft an email signature that exactly mirrors the executive's real one, including fonts, titles, and phone numbers.

3. Crafting the message

The message is tailored to sound completely authentic. It references real projects by their internal names, real colleagues by their first names, and real business terminology specific to the industry. It applies three pressure tactics in combination: urgency ("this needs to happen before end of business today"), authority ("this comes directly from the board"), and confidentiality ("please don't mention this to anyone else yet"). This trio is specifically built to bypass the normal verification instincts that employees would otherwise apply.

4. Delivery and manipulation

The email lands in the target's inbox, or in the inbox of a CFO or HR manager being told the CEO needs something immediately. Because the request looks real, references real context, and feels urgent, the recipient often complies before thinking to verify. The social pressure of appearing to doubt or slow down a senior executive's request is a significant inhibitor of critical thinking.

5. Cashing out

Wire transfers are sent to accounts controlled by the attackers, often routed through multiple international banks within minutes of receipt. W-2 data or login credentials are exfiltrated and either used directly or sold. By the time the fraud is discovered (often days later, when the real executive asks about the transfer) recovery is extremely difficult. International wire fraud recovery rates are low, and the reputational and legal consequences for the organization can persist long after the financial loss is absorbed.

Real-world examples of whaling attacks

FACC AG: over $50 million stolen, CEO fired

In 2016, Austrian aerospace manufacturer FACC AG, a supplier to Airbus and Boeing, was defrauded of more than €50 million (roughly $54–56 million), of which about €11 million was later recovered, after an employee received an email appearing to come from the CEO, requesting a fund transfer for a fictitious acquisition project described as a "fake president" initiative. The email was convincing enough that the transfer was processed without additional verification. The attack was so damaging, and the oversight failures so significant, that FACC's CEO was ultimately fired after the board concluded that inadequate internal controls had enabled the fraud. (Reuters)

Seagate: thousands of employee tax records stolen

In 2016, Seagate's HR department received a spoofed email appearing to be from the CEO, requesting W-2 tax forms for all current and former employees. The request was framed as routine and urgent. The attacker received records for several thousand current and former Seagate employees (Seagate never confirmed an exact count, but contemporaneous reporting put it below 10,000), exposing names, addresses, Social Security numbers, and salary information, data that could be used directly for tax fraud and identity theft. (Fortinet)

Snapchat: Payroll data compromised

Also in 2016, Snapchat's HR team received a phishing email impersonating the CEO, requesting payroll information for a number of employees. An HR employee complied and sent the data. The breach was identified relatively quickly, and Snapchat notified affected employees and offered identity theft insurance, but the incident drew significant public scrutiny over the company's internal verification procedures, particularly given its profile as a technology company.

Arup deepfake video call: $25.6 million lost (2024)

In one of the most alarming recent cases, a finance employee at Arup, a UK-headquartered engineering firm, was tricked at its Hong Kong office into attending a video conference call in which every other participant, including people who appeared to be senior executives the employee recognized, was a deepfake generated using AI. The employee, initially skeptical of the original email request, was reassured by seeing familiar faces on the call and authorized a transfer of $25.6 million across multiple transactions. (Vectra AI) This case marked a significant escalation: it demonstrated that even video verification, long considered a reliable out-of-band check, can no longer be treated as definitive proof of identity.

Why executives are such high-value targets

It's not just about their access to money, though that's significant. Senior executives represent a unique and unusually rich attack surface for several overlapping reasons that make them disproportionately valuable targets.

• Authority without verification. Employees are conditioned, through years of organizational culture, to comply with executive requests quickly and without question. Asking a CFO to confirm whether the CEO really sent an email can feel professionally risky. Attackers exploit this dynamic deliberately.
• Public footprint. CEOs and CFOs speak at industry conferences, post thought leadership on LinkedIn, appear in press releases, give media interviews, and are quoted in earnings calls. All of this is publicly accessible intelligence that attackers can harvest without ever touching a corporate system. The more prominent the executive, the richer the target profile.
• High-volume decision-making. Executives process hundreds of messages daily, often on mobile devices with small screens that truncate sender addresses. The cognitive load of rapid decision-making creates conditions where a carefully crafted fraudulent request can slip through scrutiny that would catch it under calmer circumstances.
• Sensitive access. Executives can approve wire transfers, grant system access, authorize vendor changes, modify payroll accounts, and release confidential HR or legal data, often without requiring additional sign-off from peers. A single compromised executive account can unlock enormous organizational resources.
• Less security training. Standard security awareness programs are built for general employees. Executives frequently skip mandatory training sessions, receive abbreviated or watered-down versions, or are granted exemptions because of scheduling constraints. The people with the most access often receive the least targeted preparation.

How to recognize a whaling email: the red flags

The defining challenge of whaling is that these emails often have none of the classic phishing red flags. No suspicious links. No malware attachments. No misspelled words. No generic greetings like "Dear Valued Customer." No requests to verify your password through a suspicious portal. The email may be perfectly written, contextually accurate, and formatted exactly like internal communications your organization sends every day.

Instead, look for these subtler signals:

Urgency combined with secrecy. Legitimate urgent requests rarely come with instructions to bypass normal processes or keep something confidential from the finance or legal team. When a message simultaneously demands speed and discretion ("we need this done today, and please don't loop in compliance yet") that combination is a significant warning sign. Real executives working on sensitive matters still operate within organizational systems.

An unusual sender domain. Look carefully at the actual email address, not just the display name that appears in your inbox. A spoofed message might display "John Smith, CEO" in the sender field but originate from jsmith@companyname-corp.com rather than @companyname.com. On mobile devices especially, one misplaced character, an extra hyphen, a transposed letter, is easy to miss when you're moving quickly.

Requests that bypass standard procedures. "Skip the normal approval process this time" is a red flag regardless of who appears to be asking. Legitimate executives, even under genuine time pressure, work within organizational systems. A request to circumvent those systems is itself a signal that something is wrong.

Wire transfers to unfamiliar accounts. Any request to wire funds to a new vendor, a foreign account, or an account that differs from established payment records should trigger immediate out-of-band verification, a phone call to a known number, regardless of who appears to be making the request.

Requests for sensitive HR or tax data. Payroll details, W-2 forms, employee Social Security numbers, or benefits information should never be transmitted via email on request alone, even if the request appears to come from the C-suite. No legitimate business process requires bypassing secure data-sharing systems in favor of an email attachment.

Contextual bait that feels too specific. A message that seems to know internal project names, colleague nicknames, or deal details isn't necessarily from an insider. It may be the result of extensive open-source research, a compromised email account, or intelligence gathered from a previous breach. Specificity is not the same as authenticity.

The AI and deepfake escalation

The whaling threat has entered a qualitatively new phase, one that renders many traditional detection methods obsolete.

Generative AI has dramatically lowered the skill and cost barriers for conducting sophisticated whaling attacks. Attackers can now use AI tools to write perfectly professional, grammatically flawless emails in any language, eliminating the spelling errors and awkward phrasing that once served as reliable red flags. They can clone an executive's voice using just a few minutes of publicly available audio (sourced from earnings calls, conference presentations, or media interviews) and use that clone to make convincing phone calls to finance teams. They can generate deepfake video that convincingly impersonates executives in real-time calls, as the $25.6 million Arup deepfake case demonstrated. And they can analyze massive volumes of open-source intelligence to personalize attacks at scale, targeting dozens of organizations simultaneously with individually tailored approaches that previously would have required weeks of manual research per target.

The practical implication is significant: the traditional advice given to employees ("look for bad grammar," "hover over links before clicking," "be suspicious of generic greetings") is increasingly obsolete as a primary defense. An AI-generated whaling email may be indistinguishable from authentic executive communication by any surface-level inspection. Defense must evolve alongside the attack, shifting from content-based detection toward process-based verification that doesn't rely on the message appearing suspicious. (Adaptive Security)

How to protect your organization from whaling

The defenses against whaling aren't complicated or exotic. What they require is consistency, organizational commitment, and the willingness to prioritize security even when it creates friction in fast-moving business environments.

1. Establish out-of-band verification protocols.

Any request involving a wire transfer, sensitive data release, or changes to payment or payroll accounts should require a secondary verification step: a phone call to a known, pre-established number, not a number provided in the suspicious email itself. This single procedural control, applied consistently, would prevent the majority of CEO fraud incidents. The key is making it a standing policy rather than a judgment call, so employees never have to decide whether a particular request warrants verification.

2. Implement email authentication (DMARC, DKIM, SPF).

These protocols make it significantly harder for attackers to spoof your executive's email addresses or send fraudulent messages that appear to originate from your domain. DMARC, in particular, prevents lookalike domain spoofing when properly configured in enforcement mode, a step many organizations skip, leaving the protocol partially effective at best. Work with your IT team to verify that all three are implemented and that DMARC is set to reject or quarantine, not just monitor.

3. Conduct executive-specific security training.

Standard phishing simulations aren't built for the C-suite and don't reflect the social engineering tactics specific to whaling. Executives need tailored training that covers how attackers research targets using open-source intelligence, what deepfake audio and video attacks look like in practice, and how to respond when they receive a suspicious request, including how to report it without disrupting legitimate business operations.

4. Reduce your executive's public attack surface.

Conduct a deliberate audit of what information about your executives is publicly available across LinkedIn, corporate websites, conference speaker pages, and media coverage. Not everything needs to be public. Consider whether detailed org chart information, EA names, or internal project references need to appear in press materials. Limiting the intelligence available to attackers raises the cost and complexity of mounting a convincing attack.

5. Apply the least-privilege principle.

Even executives should only have access to the data and systems they actively need to perform their roles. This limits the damage any single compromised account can cause and reduces the value of targeting a particular executive. Privileged access should require multi-factor authentication, and access logs should be monitored for anomalous activity.

6. Slow down wire transfers.

Implement mandatory cooling-off periods, dual-approval requirements, and callback verification for transfers above a defined threshold, regardless of who appears to be making the request. Many organizations have successfully reduced fraud exposure simply by requiring that any wire transfer above a certain amount be confirmed by two authorized individuals through separate communication channels.

7. Train finance and HR teams specifically.

These departments are the most common recipients of CEO fraud attempts, and they need explicit, scenario-based training that goes beyond general phishing awareness. They need to know that an email from the CEO requesting W-2 data, payroll records, or an urgent wire transfer should always trigger a verification call, and that making that call is not an act of distrust but a professional responsibility. Building a culture where verification is normalized, rather than awkward, is one of the most effective long-term defenses available.

Conclusion

Whaling attacks succeed not because of technical complexity, but because of human psychology. They exploit authority, urgency, and trust. They weaponize the very organizational hierarchies that make businesses run efficiently. An employee who questions a routine vendor invoice without hesitation may wire millions overseas without a second thought if the request appears to come from the CEO, because that's how deference to authority works, and attackers know it.

The good news: the defenses are straightforward. Verification procedures, email authentication, executive-specific training, and a culture where employees feel genuinely empowered to question even a "CEO request" are highly effective deterrents. None of these require exotic technology or massive budgets. They require consistency, buy-in from leadership, and the organizational willingness to slow down when something feels off, even under pressure.

The threat is sophisticated. The response doesn't have to be.

If your organization hasn't specifically addressed whaling in your security protocols, the question isn't whether you'll be targeted. It's whether you'll recognize it in time.

Get started with a free scan