The problem is that we CAN be fooled — by the smarter kind of scammer. These dastardly digital conmen are out in force, snooping into our business and sniffing out our points of weakness. One of their sneakiest schemes is called WHALE PHISHING.

This technique is based on the idea that if your goal is to steal money or sensitive information from a company, then the best people to target are its leaders — ranging from CEOs and CFOS to managers at all levels of the organisation. This is because executives and managers often have the power to authorise immediate external payments and because their computers often contain sensitive company information, which can be stolen and then held to ransom.

So, the whale phisher will start by identifying suitable managers with the power to act unilaterally. Then, they will extract money or data from them by posing as someone important: either a fellow executive or an outside individual or entity, such as a creditor, a client, a law enforcement agency, or a tax authority.

The content of the whale phishing email will often be written to create false urgency or a false threat to the organisation. For example, it might tell the ‘whale’ that the company’s IT system or machine has been hacked and that they need to download an anti-malware attachment to block the hacking attack — when in fact, the attachment itself contains malware code. In other cases, the whale phisher will tell the victim that a payment to a (fake) client or creditor needs to be made urgently or that an online form must be filled out to fulfil an urgent legal process (but in fact, the form will give confidential information to the attacker).

The anxiety triggered by a fake threat tends to trigger managers to act hastily and recklessly: our critical thinking ability is easily switched off by stressful situations. And if you genuinely believe your boss or the law is issuing the fake instruction, you are even more likely to comply without pausing to think.

The rise of AI technology has given whale phishers a devastating set of tools to impersonate someone that the whale or the whale’s assistant knows — even in live video calls. By harvesting existing video and audio footage of the person they are impersonating, the phisher can create a live ‘deep fake’ filter of that person’s face and voice during a Zoom or Teams call, along the lines of the famous ‘cat filter’ accidentally used by a US judge during a remote court hearing in 2021. The difference now is that these deep fake filters have advanced to a terrifying level of accuracy. In a recent case in Hong Kong this year, a finance worker at a multinational firm was tricked by a series of deep-faked Zoom calls into paying out US$ 25 million to a phishing syndicate.

Report incidents to our local IT department or by swiftly emailing our cyber defense team (phishingreport@sappi.com).