I know a not-incompetent technology director who bought a gift card and sent the number to a scammer, because the scammer had hacked their coworker's email address, so the request came from a legit address.