I&#x27;m an IT consultant in NYC, and no fewer than 5 of my clients have been targeted by such scams. Information on the structure of their company is gathered from their website and an email will be fabricated appearing to be a conversation between company president, controller, CFO, etc all with their real names and email addresses, sent to a company accountant or something requesting a wire transfer.<p>The final email will be sent from a very similar email domain: the scammers register a domain with a simple letter&#x2F;number substitution that is VERY difficult to visually detect if you aren&#x27;t looking. Many were registered with VistaPrint, who offer free registration of domains on a trial plan, or something. You can see a list of their recently-registered domains here <a href="http:&#x2F;&#x2F;vistaprinta.tk&#x2F;" rel="nofollow">http:&#x2F;&#x2F;vistaprinta.tk&#x2F;</a>, if you scan through it you&#x27;ll see some misspellings and l&#x2F;1 switcheroos. (I spoke with someone at Vistaprint who indicated that they are actively working on this problem, and they have taken quick action when requested).<p>When my clients ask me to take a technology approach on these matters, I encourage them to treat it as a process issue instead. Having adequate controls for issues like this (phone call required, second approver for large wire transfers, etc) is better than any futile spam-blocking action we could take.