How the attack usually runs
A convincing message from a supplier or executive requesting a payment change. Technical controls help, but the attack targets process rather than software.
The control that works
Out-of-band verification for any change to payment details, using a number you already had rather than one in the email.