I actually did see a situation just like that, and it amounted to lucky diligence on the part of a third-party that the situation was detected before it was too

I actually did see a situation just like that, and it amounted to lucky diligence on the part of a third-party that the situation was detected before it was too late. A guy in an Accounts Receivable role got phished. He went on a two week vacation, and bright-and-early on the first day he was out the phisher sent out emails as the vacationing AR person to a number of Customers advising them that remittance processing was being handled by a new third-party. They directed all the Customers to that third-party's "new" bank account. The attacker helpfully put a rule on the guy's Inbox to move new messages from every domain that the attacker emailed directly to "Deleted Items". One of the Customers thought it seemed a bit fishy and called-in to confirm that very first day.