This has happened with phishing emails - we recently had one at my workplace. Chrome's spoofing protection really helped us out with that one as even if you didn't notice it in the mail, the big blaring xn-- was enough for most people to realise it was phishing.