Whaling attacks: executive impersonation and how to break the chain
Whaling targets the people who can authorise payments. It rarely involves malware, which is why technical controls miss it — and why the countermeasure is a process, not a filter.
Whaling is spear phishing aimed at senior people, and it is better understood as fraud than as hacking. The typical attack contains no attachment, no link and no malware. It is a short, plausible email asking someone in finance to move money, and its entire mechanism is authority plus urgency.
The FBI's Internet Crime Complaint Center consistently reports business email compromise as the costliest category of cybercrime it tracks — far exceeding ransomware in total losses, despite receiving a fraction of the attention.
The two shapes it takes
Impersonating the executive
A message appears to come from the chief executive to a finance controller: a confidential acquisition, a deposit needed today, discretion requested. The sender address is a lookalike domain or a display-name spoof. There is nothing malicious in the message for a filter to detect.
Compromising the executive
Materially worse. The attacker holds the real mailbox, so messages come from the genuine address and thread naturally into existing conversations. They typically watch for weeks first, learning how invoices are approved and who signs off, before sending anything. Mailbox rules are often added to hide replies from the legitimate owner.
Why the usual controls miss it
- No payload. Attachment sandboxing and URL rewriting have nothing to inspect.
- Low volume. One message, not a campaign, so volumetric detection does not trigger.
- Often genuinely authenticated. In the compromise case SPF, DKIM and DMARC all pass, because the mail really is from that domain.
- Targets can bypass process. The people impersonated are precisely those able to say "just do it".
Controls that break the chain
Out-of-band verification, with no exceptions
Any payment above a threshold, and any change to bank details at any value, is confirmed by voice on a number held in your own records — never a number supplied in the request. The rule only works if it is absolute. An exception for urgency is an exception an attacker will manufacture.
Separation of duties
The person who can change a supplier's bank details must not be the person who can approve a payment to it. This single control defeats most of these attacks regardless of how convincing the message was.
External sender marking
A visible banner on mail originating outside the organisation. Crude, and effective against display-name spoofing, because the impersonation depends on the reader not checking the address.
Register the lookalikes
Buy the obvious variants of your domain — character swaps, hyphenation, common misspellings, alternative TLDs. It is inexpensive relative to a single successful fraud. Monitor Certificate Transparency for others registering them:
curl -s 'https://crt.sh/?q=examp1e.com&output=json' | jq -r '.[].name_value' | sort -uWatch for mailbox rule creation
Attackers with mailbox access almost always create a rule to hide replies. In Microsoft 365 this is visible in the audit log, and it is one of the highest-value alerts available:
Search-UnifiedAuditLog -Operations New-InboxRule,Set-InboxRule \
-StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)If it has already happened
- Call the bank immediately. Recall is sometimes possible within hours and almost never after a day. This comes before the internal investigation.
- Report it. In the US, IC3. In the UK, Action Fraud. Speed affects recovery.
- Revoke sessions, not just passwords. A password reset alone leaves live session tokens working.
- Audit mailbox rules and forwarding on every account involved.
- Check for OAuth grants. An application consent survives a password change.
Treat the whole episode as a process failure rather than an individual one. Whaling succeeds against competent, careful people; a culture in which the person who was deceived is blamed is a culture in which the next one stays quiet.
