Whaling vs spear phishing: what is the difference?

Spear phishing is any phishing attack aimed at a specific named person, using researched detail to make the message credible. Whaling is spear phishing where the target is a senior executive, so the same technique carries far more authority and a much larger payout.

The mechanics are identical. What changes is the value of the target. A spear-phishing email to a junior analyst yields one account. The same email to a finance director can move money directly, because that person already holds payment authority nobody will question.

Whaling also runs in the other direction. Attackers impersonate the executive rather than target them, which is why whaling, CEO fraud and business email compromise overlap so heavily in practice.

Documented cases

• At FACC, a “fake president” approach drained roughly EUR 42 million from the Austrian aerospace supplier in 2016, and cost both the CEO and CFO their jobs.
• Unatrac Holding lost $11 million after attackers took over the CFO mailbox at Caterpillar export office.
• Pathé paid out EUR 19.2 million in 2018 to people posing as head-office executives.

The control that breaks it

• Authority is not a verification method. Route every payment instruction through the same out-of-band check regardless of who appears to be asking.
• Give finance staff explicit permission to pause a request from the top. At FACC and Pathé, seniority is precisely what suppressed the question.
• Treat executive mailboxes as high-risk assets: phishing-resistant MFA, and alerts on new forwarding rules.

Related: whaling vs CEO fraud · spear phishing vs phishing · Business email compromise