[shazzy]

This actually happened to a law firm that I know of. One of their clients had their account hacked and in the client's mailbox they found emails from the law firm including some outstanding bills payable to the firm. The attacker then spoofed an email from the law firm to the client along the lines of "our bank details have changed to xxx please transfer your outstanding bill by [date]". The client didn't realise anything was wrong until the law firm chased him for the bill by which time the account the attacker had used was closed and the money moved offshore.