In my friend’s case, they monitored a compromised email account for months.

They then set up filters to hide a certain large incoming invoice via filters, and replaced it with the same thing but with a different routing number for the transaction.

A month later that vendor starts sending dunning notices, to everyone’s confusion. $90k gone.