The "urgent transfer" request sent to the CFO trick?
Yup, got a few of those and made reports to law enforcement, FWIW.
Mails were coming from a typosquatting domain name registered at GoDaddy (useful to start a UDRP request if the company lawyer has spare time). They were even using the company logo (though the one valid before the latest rebranding) and addressing the CFO by first name. Nice.
The problem was that the request for urgent payment into some panamian outfit was for a product that it makes no sense for our company to handle and the attached bill looked like it was coming from the printshop annex of the local shrimp&noodles stall.
IIt all looked all a bit fishy.
Might make sense if the CEO is not known to not perform not entirely reputable deals, so it might pass in some contexts.