Whaling

What it means

Whaling is spear phishing aimed at the “big fish”, the senior executives who can authorise large payments or access sensitive information. Instead of a generic scam email, the attacker researches the target and crafts a highly tailored message that fits their role, relationships, and current business, such as a live acquisition, a board matter, or a major supplier. The goal is to get the executive to act on the message directly, or to lend their authority to a request that pressures staff below them. A typical Australian example is a CFO receiving what appears to be a confidential note from the managing director about a pending deal, asking them to personally approve an urgent transfer outside the normal process.

Why it matters for Australian finance teams

Whaling is dangerous because senior approvals are trusted and rarely questioned, and because executives are busy and often reviewing messages on mobile devices where warning signs are easy to miss. Business email compromise and executive impersonation are among the highest-value scams reported to the ACCC and Scamwatch, with individual losses frequently in the hundreds of thousands of dollars. A single successful whaling email can convert executive authority straight into a fraudulent payment.

How ezyshield helps

ezyshield cannot stop a deceptive email from arriving, but it removes the payment that whaling is engineered to produce. Before money moves, ezyshield confirms the person, the business through ABN and ASIC records, and that the payee owns the nominated bank account, and re-verifies on any change, so even an executive-approved instruction cannot send funds to an unverified account. Every check is recorded in an append-only audit trail. See how it works and CEO fraud.