Whaling

Whaling is a type of phishing scam where fraudsters send emails to employees of financial institutions impersonating a senior executive requesting that they transfer funds into an external account urgently. The employee processes the payment, as he/she believes that the request came from a senior executive (CEO or CFO), and the fraudsters get away with the money. Financial institutions and private businesses are the primary targets for these scams, which generally require a lot of planning to be successful.
 

• Getting to know the targeted executive Fraudsters often make use of social engineering to gather information. They trawl through social media sites and may even contact employees in the organisation to gather the required information. The fraudsters may even go as far as getting a copy of the email template and electronic signature used by the targeted executive to make the email seem more legitimate.
• Getting to know who holds the purse strings

 Fraudsters determine who in the organisation is able to make large payments and source the relevant contact details and any other information that they could use to make the request seem more legitimate.

• Setting the trap

Having gathered the required information, fraudsters draft an email from the executive requesting that a payment be made into an external account and forward it to the targeted employee(s), hoping that payment will be made.

• Remember

Fraudsters rely on the fact that employees will never question an instruction from an executive and will blindly follow instructions without verification. We are all very busy and often do not take the time properly to look at the format, layout, grammar and punctuation in emails we receive; we quickly scan through them before we act. 
 

• Ensure that the email address on the email received is correct and that it matches the email address on your business system. Fraudsters often make small changes, such as adding a full stop or changing one letter, hoping that you will not notice;
• Look out for odd requests and if you get an email that seems strange or out of the ordinary, contact the sender and confirm that the email came from him/her. Do not click on links in a suspicious email, as you might unknowingly download malware onto your computer;
• Be careful what information you disclose on social media; fraudsters make use of social media to gather information on their targets to make their emails seem more legitimate; and
• Don't disclose confidential information about Nedbank or your colleagues to third parties over the telephone, as you might be talking to a fraudster.
   

If you receive an email that you suspect is fake, please delete and inform Nedbank immediately through our Customer Contact Center on +264 81 959 2222. Do not respond to it and do not click on any hyperlinks in the document.