A whaling attack is a well-known phishing attack or also known as whaling phishing attack is a type of phishing  attack which often targets high-profile employees, such as CEOs or CFO who are used to steal sensitive information from a company. In most whaling phishing attacks, the attacker's goal is to manipulate the victim into authorizing high-value wire transfers to the attacker. 

Taking an example, an attacker can send an email to a CEO requesting some official payment, pretending to be a client of the company. Whaling attacks usually target individuals, which usually use title, position and phone number, which are obtained using company websites, social media or the press. 

Vital aspect to remember is whaling is a form of social engineering and malicious people will use ways to exploit already established trust structures etc. Just making your employees aware of threats doesn’t make them less risky, some hackers/attackers are well-crafted and smart enough which makes them difficult to identify.  

Whaling emails are sophisticated than normal phishing emails as they usually target chief executives and usually: 

• contain personal information about the targeted organization or individual. 

• It conveys a sense of the urgent text. 

• They are usually crafted with a deep understanding of corporate language and a sophisticated tone. 

Common Ways to Prevent Whaling Attacks: 

1. Educate employees on Whaling Attacks:
   Senior leaders and directors tend to become the target of a whaling attack, but it takes the hacker’s capability of the email recipient to make the attack successful. Employees of the company must be trained professionally to avoid phishing and whaling attacks. Keeping this in mind, educating employees about the different phishing types used by hackers/ cyber attackers can help identify when they receive a malicious/spam email. 

2. Be alert on keeping sensitive information on social media.:
   Most of the information hacker’s information use comes from social media accounts. Social media accounts can include a lot of sensitive data, hence we should be alert in not keeping sensitive information on social media. 
    
3. Cross check sending address:
   Usually, whaling emails come under the subject of some sort of urgency in order to keep victims under pressure and reply with some confidential data. Hence, one should cross-check the address to whom we are sending the email. 
    
4. Automated Solutions:
   It includes adopting special security systems to quickly identify types of whaling or phishing attack. These tools help in identifying any suspicious emails and help us not get into further risky situations. 

Generic ways to prevent phishing attacks : 

1. Rotate passwords regularly. 

2. Install firewalls. 

3. Never put any sensitive information on unsecured websites 

4. Never get tempted to pop up’s. 

5. Don’t ignore updates – Update your software/systems regularly. 

6. Get anti–phishing add-ons. 

7. Establish data protection policies. 

8. Flag external emails 

9. Educate employees on social media usage – not share sensitive information 

10. Implement phishing training  

Whaling proves to be a serious type of phishing attack, hence we all should be aware of these types of attacks and be alert and take precautions for the same.