This kind of fraud is very, very real.
A company I work with lost close to $2MM in a similar scheme. They had even followed the protocol of calling to verify the payment instructions they received, but made the mistake of calling a phone number that was provided by the thief, not the actual phone number of the intended recipient of the payment.
Do not under any circumstances ever send a wire (or Zelle or ACH payment or whatever) to someone unless you have some kind of independent verification that the payment instructions came from the actual person or company that you intend to pay.
A common attack vector is for hackers to try to spear-phish people who tend to handle wires (e.g., anyone with the title “controller” on LinkedIn) or residential real estate transactions where wires tend to get sent (e.g., title agents, escrow agents, mortgage brokers–all of whom are likely to be on email chains where wire instructions get shared). Then they lay low and watch the victim’s email, waiting for a pending transaction where they can try to impersonate the recipient of a wire, both by email AND by phone.
