Over half of organizations have seen an increase in so-called whaling attacks over the past three months, exposing them to potentially costly fraud, according to new research from Mimecast.
The email security firm polled over 400 IT professionals in the UK, US, South Africa and Australia to better understand the prevalence of this increasingly common online scam.
It found 55% of respondents reported an increase in whaling—where a fraudster emails a senior member of the finance team pretending to be the CEO in a bid to trick them into making a large wire transfer out of the company.
The most popular method of attack is domain spoofing (70%), with domain squatting (16%) some way behind.
Unsurprisingly the majority of whaling attempts impersonate the CEO (72%), while a significant minority (35%) pretend to be the CFO.
Gmail (25%) is used more often than Yahoo (8%) or Hotmail (8%), Mimecast found.
The barrier to entry for such attacks has become dangerously low, with attacks likely to increase as long as they continue to reap rewards for the online scammers, according to Mimecast cybersecurity strategist, Orlando Scott-Cowley.
“Whaling has become an effective malware-less threat for enterprises. The cost of getting it wrong and falling foul of the social engineering can be significant,” he told Infosecurity by email.
“So as a business you’ve got to make sure your staff are fully aware of the threat, and don’t simply trust what they read in emails without verifying the request by other means. Concentrate on senior members of staff as attackers will choose mid to upper managers because of the authority they carry in the business.”
Scott-Cowley added that IT managers should configure their email systems to flag any messages arriving from outside the company containing suspicious-looking content.
Just over the past year, the number of high profile whaling attacks hitting the headlines has soared—indicating that many more are likely going unreported.
Back in February it was revealed that fraudsters made off with a massive $17m from a single firm after persuading a senior exec at commodities trader Scoular to wire funds to a Chinese bank.
And in June, magazine publisher Bonnier Group fell for the same trick, this time transferring out at least $1.5m before the scam was spotted.
Photo © Tory Kallman