Whaling attack: how criminals pose as your CEO, and the five rules that stop the payment

01 What a whaling attack is

The executive plays one of two roles. Either they are the target, and the attacker wants their login, their signature or their trust. Or they are the costume, and the attacker borrows their name to push someone junior into paying. The second version has its own name, CEO fraud, and it accounts for most of the money lost.

The FBI defines BEC as fraud that uses compromised email accounts “and other forms of communication such as phone numbers and virtual meeting applications” to make unauthorised transfers [ FBI IC3 2025 ] . That definition matters. Executive impersonation stopped being an email problem some time ago.

02 The extreme case: the person at the top

On 29 October 2026 The New York Times reported that US officials had concluded Alice Huang, also known as Huang Le, a top executive at the Singapore-based data centre company Megaspeed, was a Chinese intelligence asset passing information to Beijing. According to the report, surveillance showed she had a close relationship with NVIDIA chief executive Jensen Huang. The Times said officials initially did not believe he knew what she was doing, and that he had not received a defensive briefing [ NYT 2026 ] .

Nothing in that report has been proven in public. It rests on classified intelligence described by anonymous sources. Alice Huang did not respond to the Times. An NVIDIA spokesperson said Jensen Huang’s interactions with her “are not unusual or unexpected” [ NYT 2026 ] . Huang told Bloomberg the company’s business with Megaspeed was “normal and not unusual” [ IBTimes 2026 ] . China rejected the report as groundless speculation [ Euronews 2026 ] .

We draw one point from it and no more. Whatever the truth, the story is about the oldest shape of whaling: patient attention on the one person whose access matters most. Most companies will never meet a state service. Every company with a bank account meets the cheap, everyday version, and that one runs on the same idea.

03 How whaling works at a 20 to 500 person company

Below a few hundred staff, the attacker has an easier job. Everyone knows the CEO by first name. Finance is two people. Nobody wants to be the one who delayed the boss’s deal. These are the five plays we see described again and again in the reporting.

1. The urgent payment from the “CEO” or “CFO”

An email arrives from the chief executive, or a lookalike of their address. A deal is closing, it is confidential, the money has to go today, and they are in meetings so cannot talk. UK Finance describes the method plainly: the criminal either gets into the company’s email system or uses spoofing software to send a member of the finance team what looks like a genuine email from the CEO [ UK Finance 2026 ] .

2. The cloned voice or the deepfake call

In 2024 Arup confirmed that an employee in Hong Kong sent HK$200m (about £20m) to criminals after a video conference with people posing as senior officers of the company. Hong Kong police said the money left in 15 transactions to five local bank accounts, and Arup confirmed that fake voices and images were used [ Guardian 2024a ] .

The same month, WPP chief executive Mark Read warned his leadership team about an attempt on the company. Fraudsters set up a WhatsApp account with his public photo, opened a Teams meeting, and used a voice clone plus YouTube footage of an executive. The attempt failed. “Just because the account has my photo doesn’t mean it’s me,” Read wrote [ Guardian 2024b ] .

3. The executive assistant’s inbox

Assistants often hold delegated access to the CEO’s mailbox and calendar. They see every meeting, every investor and every supplier. Their own account usually has less protection than the boss’s, and a message from it carries the boss’s authority. Compromise the assistant and you can reply inside real threads, at the right moment, with no spoofing at all. If an IT provider runs your email, ask them about our dark web credential check: it shows whether a password from that inbox is already for sale.

4. Travel posted on LinkedIn

“Excited to be speaking in Singapore this week.” For a fraudster that post is a timetable. The CEO is in the air, hard to reach and in a different time zone, which is exactly when an “I can’t talk, just send it” message works. The NCSC tells organisations to think about what their website and social media give away, and says this matters most for high-profile staff, because the detail “could be used to craft personalised whaling attacks” [ NCSC 2026 ] .

5. The supplier’s new bank details

A known supplier writes to say its bank has changed. Sometimes the email comes from the supplier’s real, compromised account, in the real thread, attached to a real invoice. UK Finance counted 2,305 invoice and mandate scam cases in 2025, with £41.3m lost, and 68% of the losses (£28m) came from business accounts [ UK Finance 2026 ] . When the “supplier” is your own managing director asking you to pay a new firm, it is the same fraud wearing a better suit.

04 What CEO fraud costs

The FBI’s Internet Crime Complaint Center received 24,768 business email compromise complaints in 2025, up from 21,442 in 2024. Reported losses reached $3,046,598,558, second only to investment fraud [ FBI IC3 2025 ] . That works out at roughly $123,000 per complaint. For a company of 50 people, one of those is a bad year.

The long view is worse. Between October 2013 and December 2023, the FBI counted 305,033 BEC incidents worldwide with $55.5 billion in exposed losses [ FBI PSA 2024 ] . Artificial intelligence now shows up in the data too. The FBI says chat generators write convincing emails in a CEO’s name and voice cloning can request wire payments, and businesses reported more than $30 million in 2025 losses to BEC scams involving AI [ FBI IC3 2025 ] .

In the UK, UK Finance recorded 197 CEO fraud cases in 2025 and £5.6m in losses. That is the lowest case count it has ever reported. Each case still hurt: an average of just over £28,000, the highest of the eight authorised push payment scam types it tracks. Only 20% of the money came back [ UK Finance 2026 ] .

Read the UK figures with care. UK Finance counts losses reported to its member banks as authorised push payment fraud. A firm that never reports a loss, or pays through another route, is not in the table. The FBI makes the same point about its own data: it covers what victims choose to report.

05 Five rules that stop the payment

Training helps people spot some fakes. It will never catch a perfect one, and the Arup call shows how good a fake can be. The NCSC says plainly that no training package can teach users to spot every phishing attempt [ NCSC 2026 ] . So build rules that hold even when the fake is flawless.

The Ferrari case shows the last rule in action. In July 2024 an executive received WhatsApp messages and then a call from someone using a voice that imitated chief executive Benedetto Vigna, talking about a confidential acquisition. He noticed small mechanical tones in the voice. He said, “Sorry, Benedetto, but I need to identify you,” and asked for the title of a book Vigna had recommended days earlier. The call ended [ Bloomberg 2024 ] .

One more rule sits under all five. Write down that any employee may refuse an instruction from the CEO until it is verified, and have the CEO say so in front of everyone. Whaling works on deference. A finance assistant who fears being shouted at for a delay will pay. One who has heard the boss thank someone for checking will not. The NCSC adds a supplier-side step: tell your customers and suppliers that your bank details will not change, so they have one more chance to spot a fake [ NCSC 2026 ] .

06 What a social engineering test checks

You can write the rules above in an afternoon. The harder question is whether people follow them at 17:40 on a Friday when the “CEO” is shouting. A social engineering test answers that with evidence instead of a policy document. A whaling-focused test, run with the board’s written approval, usually covers:

• Reconnaissance. What an outsider can learn about your executives, assistants, finance staff, suppliers and email format from public sources in a few hours.
• Email controls. Whether your domain can be spoofed, whether a lookalike domain gets through filtering, and whether external mail is labelled.
• The payment path. A controlled request to change supplier bank details or make an urgent transfer, stopped before any money moves, to see whether the callback and second approval actually happen.
• Voice and messaging. A call or WhatsApp message in an executive’s name to the assistant or finance team, with the executive’s consent.
• Reporting. How fast someone reports the attempt, and whether the report reaches a person who acts on it.

The point is never to catch individuals out. The NCSC warns that punishing staff for clicking erodes trust and stops people reporting [ NCSC 2026 ] . A good test measures the process, and it counts the people who raised the alarm alongside the people who were fooled. It also pairs well with a technical network penetration test, because a whaling email that steals an assistant’s password is the start of a network intrusion as often as it is a payment fraud.

Every company has someone who would pay if the right name asked in the right tone. You can find out who before a criminal does. We run the whaling scenario from this article against your own company: the lookalike domain, the urgent request, the call in your executive’s name, stopped before a penny moves. You learn which step held, which step failed, and the fix for each, proven and in writing. Your red team. Within reach.