Whaling

Description

The messages are matched to the recipient's role, language and responsibility. They can look like a legal letter, a board request, confidential financial correspondence, an urgent acquisition decision, or a message from an important partner. The attack counts on executives working fast, often from a phone, and handling a great deal of confidential correspondence.

Successful whaling does not just carry off a password. It can set a large payment in motion, open access to strategic documents, compromise negotiations, or serve as the entrance to the rest of the organization. The higher the role, the greater the consequences of one thoughtless move.

Examples

• A director receives a fake legal letter with a link to a login page, supposedly to review a confidential document urgently.
• A finance director receives a message that looks like the owner's request for an urgent payment, with a note that the correspondence is not to be forwarded.
• A board member receives a false invitation to access board documents, and the login leads to a page that steals credentials.

Notes

• A senior position does not reduce the risk; it raises the value of the target.
• Management is not an exception to the procedures. The opposite: for them the procedures have to be clearer, shorter and stricter.