SecurityRingBook a Demo

Glossary

What is whaling? Phishing that targets executives

A form of spear phishing that targets a senior person, such as a board member or executive, who has access to valuable assets or can approve payments.

How it works

The UK NCSC describes whaling as a type of spear phishing that targets a “big phish”, such as a board member who has access to valuable assets. It advises organisations to think about what their website reveals about high-profile people, because those details can be used to craft personalised whaling attacks.

A real example

The FBI’s BEC warning describes scams that compromise or impersonate business email accounts to request transfers of funds. Those requests carry the most weight when they appear to come from, or are sent to, a senior executive.

How to train for it

  • Include executives and their assistants in simulations, not just staff.
  • Agree verification rules for payment and data requests that senior people follow too.
  • Review what public pages say about leaders’ roles and schedules.

SecurityRing’s deepfake training uses a consented deepfake of your own leaders, so staff practise checking a request that appears to come from the top.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. UK National Cyber Security CentrePhishing attacks: defending your organisationAccessed 17 October 2026.
  2. FBI Internet Crime Complaint CenterBusiness Email Compromise: The $55 Billion Scam (PSA I-091124-PSA)Published 11 September 2024 · Accessed 17 October 2026.