Have regularly seen fake email requests pretending to be an employee and asking to change their direct deposit details. This is the same sort of attack, except stealing an employee’s HR portal credentials https://lnkd.in/gKg4ysv7

Sources:
[Link]