Whaling vs CEO fraud: what is the difference?

Whaling describes an attack whose target is a senior executive. CEO fraud describes an attack that impersonates one. The direction of the deception is the difference: in whaling the executive is the victim, in CEO fraud the executive is the disguise.

They often appear in sequence. A whaling attack that captures an executive mailbox supplies exactly what the following CEO fraud needs, which is a real account, real correspondence and real knowledge of who pays what.

Documented cases

• Executive as disguise: FACC lost roughly EUR 42 million to a fake-president approach.
• Executive as target: Unatrac shows the CFO own mailbox being taken over before $11 million moved.
• Both at once: LastPass saw its chief executive voice cloned, and an employee refuse to act on it.

The control that breaks it

• Protect executive accounts as tier-one assets, since one compromise enables the next attack.
• Verify payment instructions out of band no matter how senior the apparent source.
• Watch for the handover signal: new mailbox rules on an executive account often precede a payment request.

Related: whaling vs spear phishing · CEO fraud vs BEC · CEO fraud