Call us at (877) 892-8249
The email looks perfect. It has your business partner's name in the sender field, their usual sign-off, even that slightly formal tone they use when something is time-sensitive. The message is short. There's an urgent wire transfer that needs to go out today, before the bank closes. They'll explain later. Just get it done.
That is whaling phishing. Not the kind of scam that ends up in your spam folder. The kind that gets through because someone did their homework on you, your business, and the people you trust before they ever hit send.
If you run a small business without an IT department behind you, you are exactly who these attacks are designed to fool. So what can you do when a message looks right but something still feels off? Use a tool like OmniWatch to check a suspicious message before you act on it, because the cost of a quick check is nothing compared to the cost of getting it wrong.
Key takeaways
- Whaling phishing targets executives and the people who handle their money, including bookkeepers, assistants, and small business owners who wear both hats.
- It is a subtype of spear phishing, distinguished by the seniority of the target being impersonated and the level of research behind the attack.
- Attackers study their targets before striking, using LinkedIn®, company websites, and public records to make the impersonation convincing.
- The FBI reported $3.05 billion in business email compromise losses in 2025.1
- Banks typically will not cover authorized wire transfers, even when the person sending the money was deceived into doing it.
- OmniWatch scam protection can help cover wire transfer fraud and phishing losses, including transactions the victim authorized under false pretenses.*
What is whaling phishing in cybersecurity, and how is it different from regular phishing?
Whaling is a type of phishing attack that targets senior executives, business owners, and the people who manage their finances. The name comes from the idea that these targets are the big fish, the ones worth the extra effort it takes to fool them.
Regular phishing casts a wider net.
In a regular phishing scam, an attacker sends the same email to thousands of people and waits to see who clicks. Whaling works the opposite way. The attacker picks a specific target, researches them thoroughly, and builds an email that is designed to fool that one person specifically. That research investment is what makes it extra dangerous. By the time the message arrives, it does not look like a scam. It looks like something that actually came from someone the target knows and works with.
Most whaling attacks connect to what the FBI calls business email compromise, or BEC.2 The attacker does not need to break into any system. They just need to convince the right person to authorize a payment or share information they shouldn't. No malware, no suspicious links, just a well-written email and a sense of urgency.
For small business owners without a computer security team, this is a serious risk. The AFP's 2025 Payments Fraud and Control Survey found that 63 percent of organizations faced BEC attacks in 2024.3
How do whaling vs. spear phishing differ?
Whaling is a type of spear phishing, just with a much more specific target in mind.
Spear phishing is any phishing attack that goes after a specific person rather than a random crowd. Your name is in the email. It references something real about you. It feels personal because it is.
Whaling uses a similar method but changes the focus. Instead of targeting anyone with access, attackers pretend to be top leaders like CEOs, CFOs, or business owners. Their names carry enough authority to make a payment request seem unquestionable.
If spear phishing is like a sniper, whaling is a sniper who has studied their target for weeks or even months.
In a classic whaling attack, the executive is not the one being fooled. They are the one being impersonated. The actual target is the bookkeeper, the office manager, the assistant, or the business owner themselves if they handle their own finances. Someone receives an email that appears to come from a senior authority figure and acts on it because the request looks legitimate and the pressure to move quickly feels real.
If you are the only person in your business who approves payments, you are simultaneously the whale and the target. That is a uniquely uncomfortable position to be in.
Spear phishing vs. whaling phishing at a glance
Generic phishing | Spear phishing | Whaling | |
Who gets targeted | Anyone with an email address | A specific individual, chosen for a reason | Senior executives, business owners, or the people who handle their money |
How much research goes in | None | Some, enough to personalize the message | Significant, weeks of studying the target's relationships, routines, and communication style |
What the email looks like | Generic, often full of typos and odd formatting | Personalized but not always polished | Polished, on-brand, and nearly indistinguishable from a real internal email |
How they create pressure | Fake urgency, fear of losing access | Personal context that makes the request feel legitimate | Authority plus urgency, a senior name telling you something needs to happen right now |
Typical goal | Steal credentials, get clicks on a malicious link | Access sensitive data, steal credentials, redirect payments | Authorize a large wire transfer, hand over financial account details, or share data that enables further fraud |
What happens if it works | Usually a smaller, recoverable loss | Moderate to significant financial or data loss | Potentially tens or hundreds of thousands of dollars wired to an account that disappears |
Who is most at risk | Everyone | Employees in specific roles | Senior executives, small business owners, or the people who handle their money |
Will your bank cover it | Sometimes, if unauthorized | Unlikely if you authorized the transaction | Almost certainly not, because you sent the money yourself |
How does a whaling phishing attack actually work?
Whaling attacks do not happen in a hurry. The average attack involves days or weeks of research before a single email gets sent.
Here is how it typically unfolds.
Phase 1: research
In the first phase, the attacker learns everything they can about their target. They search any available public data, such as:
Social media profiles
Company websites
Press releases
News mentions
They look for names, relationships, communication habits, reporting lines, current projects, travel plans, and anything else that makes their impersonation believable.
Phase 2: impersonation
Armed with that research, the attacker builds the email. They might spoof the sender address so it looks legitimate at a glance, register a lookalike domain with one character swapped, or, in some cases, compromise an actual email account to send from. Because they’ve been researching, they also have a good idea of the person's tone and voice.
Phase 3: urgency and authority
The message the attacker sends is meant to create pressure to act quickly. It is time-sensitive and needs to happen before the end of the day. Normal approval channels should be bypassed just this once. The authority of the name in the sender field is doing a lot of the work here, which is exactly why it was chosen.
Phase 4: the request
The attacker often asks for a wire transfer to a new account, a change in payment details for a vendor, or sensitive financial information. These requests either move money right away or make it easier to do so later.
The 2026 twist: attacks that do not stay in email
Increasingly, attackers are not stopping at email. Once initial contact is made, some attempt to move the conversation to Signal®, Telegram®, or WhatsApp®, citing computer security or confidentiality.
This gets the target off any platform where a suspicious message might get flagged, and onto one where the attacker has more control. AI-generated voice impersonation is also showing up, with fake audio clips designed to sound like a known executive confirming the request.4
Real whaling attack examples
It’s one thing to read about whaling in theory. It’s another to see the real impact on people and organizations.
How a BEC scheme cost small businesses $50 million in New York before its 2026 guilty plea
In April 2026, Animashaun Adebo, known as "Kazeem," pleaded guilty in Brooklyn federal court to wire fraud conspiracy. The scheme targeted individuals and small businesses across the Eastern District of New York, ultimately causing more than $50 million in losses. Two co-conspirators were extradited from Paris and pleaded guilty separately—a fourth remains at large.5
What makes this case relevant to small business owners specifically is who the victims were. Not Fortune 500 companies with fraud detection teams. Individuals and small businesses, the exact people least likely to have a system in place to catch this kind of thing before the money moves.
How scammers redirected $6.7 million from the city of Portland by impersonating a vendor
In May 2025, the Department of Justice filed a forfeiture action to recover $6.7 million stolen from the City of Portland through a vendor impersonation scheme.6 The attackers changed a legitimate contractor's bank account details to redirect payments to a fraudulent account. The city processed the payment through normal channels because everything appeared to be in order.
How a 25-person BEC network stole $215 million from over 1,000 victims across 47 states
In April 2026, the DOJ announced convictions in a $215 million BEC scheme out of the Northern District of Ohio. Twenty-five defendants were convicted. The scheme affected more than 1,000 victims across 47 states and 19 countries. One company alone wired $2.7 million to a shell account before realizing what had happened.7
This case shows that these are not lone scammers running small schemes. They are organized groups targeting anyone they can, no matter the size of the business.
How to tell if a request is a whaling phishing attempt
A well-executed whaling attack is hard to catch in the moment. But most attacks share at least a few of the same patterns.
Urgency plus authority. A “senior partner” creating pressure around a financial request. The urgency is manufactured. The authority is borrowed. Neither is a reason to skip your normal verification steps.
Something feels off about the timing. The request arrives while someone is traveling, late on a Friday, or through a channel you wouldn't normally use for this kind of thing. Attackers time these deliberately.
The sender address does not quite match. The display name looks right. The actual email address has one character swapped, or it is coming from a personal account entirely.
You are being asked to keep it quiet. Legitimate urgent requests do not come with instructions to bypass your normal approval process.
The payment details are new or recently changed. Verify any request to wire money to a new account or update existing vendor details by calling the person directly using a number you already have, not one included in the email.
If a message hits more than one of these and involves a financial request, pause before you do anything. OmniWatch lets you check a suspicious message before you respond, which costs a lot less than finding out the hard way.
What to do if you already sent money because of a whaling phishing scam
First, do not panic. Panicking wastes the time you actually have to do something about it. Move fast, but move deliberately.
Stop any further transfers immediately. If there are additional payments pending or requested, halt them now. Do not send anything else until you know what you are dealing with.
Call your bank's fraud department immediately. Wire recalls are time-sensitive, and the window to recover funds narrows quickly. Ask specifically about a SWIFT recall if the transfer went internationally.
Report to the FBI's Internet Crime Complaint Center. File an official complaint. The IC3 works with financial institutions to freeze and recover fraudulent transfers, but only if you file a report quickly.
Report to the FTC. File an official report. This helps build the federal case against the people running these schemes and may support any recovery efforts.
Document everything. Save the original email, any follow-up communications, the transfer confirmation, and a timeline of what happened. Do not delete anything, even if it is embarrassing. You will need it.
Notify anyone else who may have received similar requests. If the attacker impersonated someone in your network, others may have gotten the same email. A quick heads-up could stop another loss.
Does insurance cover whaling or business email compromise losses?
When you approve a wire transfer, most banks see it as a valid transaction, even if you were tricked. Standard fraud protections usually do not apply if you authorized the payment yourself, even if it was under false pretenses.
That is the specific gap OmniWatch scam protection is built to help bridge. Coverage applies to wire transfer fraud and phishing losses, including authorized transactions, because OmniWatch covers 94% of FBI-tracked cybercrime, including BEC.*
The scam lasts a minute. The loss can last a lot longer.
Explore scam protectionFrequently asked questions
What is whaling in cybersecurity?
Whaling is a targeted phishing attack that impersonates a senior executive or trusted authority figure to trick someone into wiring money or sharing sensitive financial information. Unlike generic phishing, which goes out to thousands of random recipients, whaling is built around a specific target after significant research into their business, relationships, and communication style.
What is the difference between whaling and spear phishing?
Whaling is a form of spear phishing, which means every whaling attack is a spear phishing attack, but not every spear phishing attack is whaling. Spear phishing targets a specific individual for any reason. Whaling specifically impersonates senior executives or business owners, using their authority and name recognition to make a fraudulent payment request feel legitimate. The research investment and the size of the typical financial target are both significantly higher in a whaling attack.
Who is the target of a whaling attack?
The executive being impersonated and the person receiving the request. In most cases, the executive's identity is used as a weapon, not compromised directly. The real target is whoever handles payments, such as a bookkeeper, office manager, or small business owner who manages their own finances. If you are the person who approves wire transfers in your business, you are the target regardless of your title.
What should I do if I fell for a whaling scam?
Call your bank's fraud department immediately and ask about a wire recall. File a complaint with the FBI and report it to the FTC. Document everything, including the original email and transfer confirmation.
Does insurance cover business email compromise?
Standard bank fraud protections and most personal insurance policies do not cover authorized transfers, even ones made under false pretenses. OmniWatch scam protection is designed specifically for this gap, covering wire transfer fraud and phishing losses, including transactions the victim authorized. Restrictions and exclusions apply, coverage varies by plan tier, and there is a New York carve-out.* Check the OmniWatch website for current plan details.
This guide is published by OmniWatch. Follow OmniWatch on Facebook for ongoing guidance on identity protection, digital safety, and scam awareness.
*Restrictions and exclusions apply, click here to read full details of insurance coverage.
Sources
1 Federal Bureau of Investigation, 2025 Internet Crime Report
2 Federal Bureau of Investigation, Business Email Compromise
3 Association for Financial Professionals, 2025 AFP Payments Fraud and Control Survey Report: Key Highlights
4 Federal Bureau of Investigation, FBI Warns of Scammers Impersonating the IC3, 2026
5 U.S. Department of Justice, Nigerian National Pleads Guilty to Series of Multi-Million Dollar Business Email Compromise Schemes, 2026
6 U.S. Department of Justice, United States Files Forfeiture Action to Recover $6.7 Million in Stolen Funds, 2025
7 U.S. Department of Justice, 25 Defendants Convicted in International $215M Scam That Targeted 1,000+ Victims, 2025