What Are Whaling Attacks And Why Your Board's Best Habits Are The Target

In early February 2024, Hong Kong police described a fraud that began with a message its intended victim did not trust: an employee in the Hong Kong office of a multinational company received an apparent request from the company's UK-based chief financial officer to execute a confidential transaction, and immediately suspected phishing.

He was subsequently invited to a video conference on which the chief financial officer appeared alongside several colleagues he recognised by face and voice. Persuaded of their authenticity, he executed the transfers requested, totalling HK$200 million, approximately US$25.6 million. Every other participant was a deepfake; he discovered the fraud only when he subsequently contacted head office, and the police did not identify the company.

Why did the call work?

If you serve on a board, reread the case, because the technology contributes surprisingly little beyond a familiar face. What overrode the employee's suspicion were three habits that every well-governed organisation deliberately cultivates: deference to a senior colleague, respect for an instruction to maintain confidentiality, and trust in recognisable people within a meeting to which he had been formally invited.

Security specialists have a name for that pattern. The UK's National Cyber Security Centre describes whaling as "a type of spear phishing that targets a 'big phish', such as a board member who has access to valuable assets." The Hong Kong attack travelled downwards, from an impersonated executive to an employee; directed at a board, the same three habits are not weaknesses to be trained out of anyone, because they are embedded in how boards are supposed to operate. As ethical hacker Glenn Wilkinson told the Chartered Governance Institute Scotland conference in 2025, hackers do not start with technology; they start with the people.

What does a whaling attack look like in a boardroom?

Consider the Friday preceding a Monday board meeting. You are a non-executive director, and a message arrives from your chair, who is travelling internationally: a confidential transaction must complete before the announcement, a written resolution requires your signature tonight through the attached link, and because the matter is price-sensitive, you should not discuss it with anyone.

Every element of that message is plausible precisely because every element reflects good governance. Directors are expected to preserve the confidentiality of price-sensitive matters, to act on the chair's request without convening a meeting for every signature, and to respect the deadlines that board calendars and transaction timetables genuinely impose. Attackers require no inside source to assemble such a message, since annual reports and regulatory announcements identify every director and, frequently, the company secretary responsible for circulating board papers.

For UK organisations, the exposure is quantifiable. According to the government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, 43% of businesses identified a breach or attack during the previous twelve months, rising to 69% of large businesses, and 38% experienced phishing; nevertheless, board-level responsibility for cyber security existed in only 31% of businesses and in 68% of large organisations.

Doesn't verifying a request put the deal at risk?

Propose a mandatory call-back rule to a chair in the middle of a transaction and you may encounter a reasonable objection: every additional telephone call represents another conversation about a deal that must remain confidential, and a board that verifies everything by telephone could ultimately disclose more than it protects.

For a listed company, that concern has a legal foundation. Under the Market Abuse Regulation, an issuer delaying the disclosure of inside information may do so only while it "is able to ensure the confidentiality of that information" (Article 17(4)(c)), and it must maintain a list of all persons with access to that information (Article 18). A chair resisting wider conversations is therefore protecting something genuine.

Nevertheless, the objection proves less than it appears to. A call-back reaches the person who supposedly sent the request, who already belongs to the circle of insiders, using a number the director already holds, so it adds nobody to the insider list maintained under Article 18. What it does disrupt is the instruction attackers depend on most: do not discuss this with anyone. The objection carries greatest weight on boards that have never agreed, in advance, that verifying a request with its apparent sender is not equivalent to discussing it.

What has changed since 2024?

Two developments have raised the stakes since early 2024. The first concerns cost: the NCSC assessed in May 2025 that threat actors are already using artificial intelligence to support access to systems through social engineering, and that AI will highly likely increase the volume and impact of cyber intrusions through to 2027. In the United States, the FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with losses slightly exceeding US$3 billion, including more than US$30 million attributed to schemes involving artificial intelligence. A convincing voice or face has become inexpensive to manufacture.

The second concerns accountability. For UK listed companies, Provision 29 of the UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026, requiring the board to declare whether its material controls operated effectively at the balance sheet date. On 23 September 2026, the Financial Reporting Council published a cyber mythbuster observing that many companies are likely to treat cyber security as a material control, and confirming that the declaration does not guarantee protection against a subsequent incident. A whaling attack succeeding through the board's own habits therefore sits uncomfortably close to a declaration the board itself makes.

Which decisions can only the board take?

Much whaling guidance is addressed to information technology teams. The decisions that matter here can only be taken by the board, because they modify board habits rather than software.

1. Decide the channel. Agree that board papers, written resolutions and signatures travel through one authenticated route exclusively, so that any request arriving another way is presumed suspicious, however senior the apparent sender.
2. Decide what confidentiality permits. Record in the minutes that verifying a request with its apparent sender, using a number already held, never constitutes a breach of confidentiality. This addresses the chair's objection where it is weakest and eliminates the attacker's leverage where it is strongest.
3. Decide how directors authenticate. Require multi-factor authentication for every director on every device, including personal tablets and the accounts of newly appointed directors; the NCSC identifies it among the principal protections against the consequences of successful phishing. See why two-factor authentication matters.
4. Decide who is briefed first. The chair and the company secretary represent the identities most worth impersonating. The Financial Reporting Council notes that board members need sufficient knowledge for constructive discussions about cyber risk, and the government offers free Cyber Governance Training for boards.

Where does a board portal help, and where doesn't it?

A board portal supports the first and third decisions. In Admincontrol, every user authenticates with two-factor authentication, using a one-time code or an authenticator application, and Nordic organisations can use strong electronic identification such as BankID. Board packs, secure messaging and legally binding electronic signatures remain inside the platform and the Admincontrol application for iOS and Android, so a request to sign through an email link is inconsistent with established practice by design (see 7 things a board portal does that email can't). Role-based access control ensures each director sees only the boards and documents they are authorised to access. Admincontrol is GDPR compliant, provides bank-grade security and is ISO 27001:2022 certified, as detailed in the Trust Centre, and more than 7,500 boards use it.

It cannot resolve the second or fourth decisions: no platform intercepts a cloned voice on a mobile telephone, and none can determine, on the board's behalf, what confidentiality permits.

The question for your next board meeting

The chair's objection never disappears entirely. Eventually there will be an evening when the chair is airborne, the signature is due before midnight, and verification is only possible the following morning. Whether your board would rather miss a deadline or sign unverified is not a question an information security policy can answer, and it is considerably easier to answer during a calm board meeting than at 23:40 in a hotel lobby.

See how Admincontrol keeps board papers, resolutions and signatures in one authenticated channel. Book a demo

Frequently asked questions about whaling

How is whaling different from phishing, spear phishing, business email compromise and CEO fraud?

Can email security filters stop whaling attacks?

Not reliably in isolation. Whaling messages frequently contain no malware and may originate from a lookalike domain or a genuine but compromised account, so they can pass technical checks. The NCSC advises that "all important email requests are verified using a second type of communication".

What should a director do immediately after clicking a link in a suspicious message?

Notify your information security team and change the password immediately, so that active sessions can be revoked and the account reviewed. Inform the company secretary so the remaining directors can be warned, and if a payment was authorised, contact your bank's fraud team without delay.