https://www.cnbc.com/2019/04/09/new-wire-fraud-scam-targets-your-direct-deposit-info-paycheck.html

Around two or three times per month, KVC Health Systems, a mid-sized non-profit agency for child welfare based in Kansas City, receives phishing emails from criminals with the goal of re-routing an employee's paycheck by direct deposit.

The emails look legitimate at first, as though they come from the CEO, CFO or payroll director.