A whaling attack, also known as Business Compromise Email (BEC) attack, is a type of phishing cyberattack targeted to high-ranking executive of a company, often with the intent of tricking their employees into wiring them money or revealing sensitive information.
RMail Reply Hijack feature protects Microsoft Outlook users against whaling attacks. The patent pending RPostONE Anti-whaling security feature uses proprietary algorithms to analyze email message characteristics, flagging a message when it appears to be an “impostor email”. The new feature is available now in the newest release of RPostONE for Outlook add-in, which RMail customers can obtain by request.
- In a whaling attack, there is often no telltale link to a fraudulent website.
- The fraudulent email contains information specific to a transaction the victim is aware of and appears to be sent by a trusted individual.
- Anti-Whaling security protects RMail users from impostor emails by analyzing message structure and issues a warning when the user is about to reply to a suspected impostor email. This analysis is conducted when for all REPLY, REPLY ALL or FORWARDED emails (not just messages sent with the Send Registered service button).
Example whaling message and workflow
There are two anti-whaling alert levels, Caution and Warning which appear depending on the matching whaling criteria and level of severity detected with the RPostONE proprietary algorithms.
Anti-Whaling Warning Example:
1. An email arrives in the inbox with one email address in the From field:
- Name: Jim Davis (known sender)
- Email Address: jimdavis@company.com (known sender address)
2. The Reply, Reply All or Forward button is pressed and the RPostONE for Outlook detects a cyber threat:
- Name: Jim Davis (known sender)
- Email Address: jimdavis@cybercriminal.com (unknown reply address)
In this example, the user will see a warning pop-up to stop them from unsuspectingly sending information to a cybercriminal.
The settings for Reply Hijack can be found in the RMail Feature Dialog box or by clicking the File menu from your Inbox in Outlook Desktop and then selecting RPostONE Settings.
Note: IT staff can prevent users from disabling this feature, or disable the ability just for selected users, with a custom installation configuration, through our Professional Services team. Please contact your RPost account manager for more details.