A workers’ union in Massachusetts received last year an email purportedly from an employee of an investment consulting firm, requesting a payment change. The address looked legitimate and off went US$6.4 million to a fraudulent account.