Whaling: Like Phishing, but After Bigger Game

Conceptual image of micro circuit. Security conceptOrganizations have to acknowledge their responsibility for ensuring their employees are able to recognize targeted phishing attacks, according to James McGachie, Legal Director of DLA Piper Scotland. Writing in The Herald, McGachie explains that sophisticated spear phishing attacks designed to steal large amounts of money (also known as "whaling"), should be of special concern to companies.

McGachie cites a recent case Scotland in which an employee of a media company fell for a spear phishing attack that arrived by email and was and was tricked into transferring £193,250 to an attacker. The employee was subsequently sued by her employer for the money, with the company arguing that the employee breached her contract by failing to exercise reasonable care. The company held that the phishing emails were “obviously fraudulent.”

The judge ultimately ruled that the employee wasn’t responsible for reimbursing the company for the stolen funds, since she didn’t know she was communicating with a fraudster.

McGachie explains that “while holding that the decision to transfer company funds without any authority was in breach of contract, Lord Summers did not consider that the loss that ensued was the natural consequence of the breach, finding that it was ‘exceptional and unnatural’ because the controller was unaware of the fraud being perpetrated. Accordingly, the action was dismissed.”

McGachie stressed that organizations need to realize their responsibility in this realm before it’s too late.

“From a practical perspective the case highlights the need for employers to ensure staff – particularly those in cash or credit control handling functions – are fully trained and aware of the tell-tale signs of both phishing and whaling scams,” McGachie writes. “Such training may take the form of practical testing through running ‘spot checks’ through deploying ‘test’ phishing and whaling messages to establish if the training has been successful.”

Employees shouldn’t be held responsible for falling for social engineering attacks, especially if they haven’t been taught how to defend themselves. New-school security awareness training can give your employees experiential knowledge of these attacks.

Microsoft has the story: https://www.microsoft.com/security/blog/2019/12/11/the-quiet-evolution-of-phishing/  

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews