I handled one of these for a client that involved $8,000 being paid to the thief in University City in the South, just last month. Think it was Oxford Mississippi.
Using the recipient bank’s information, I managed to have the thief’s bank accounts frozen and the funds returned. But you must act quickly.
I’m a retired forensic CPA so this brought back many old memories.
These usually begin with an email phishing for access to your email account. They will act as your email provider and give you a link to change your access password.