1.  Lawyer was involved with closing a legitimate transaction.  The day before the closing, lawyer received an email from the legitimate party’s email address, changing the instructions for wiring the money to a Malaysian bank.  It appears the legitimate party’s email was hacked.

Good loss prevention indicates that wiring instructions should be changed only with additional confirmation of the request.  The follow up should be via phone call to a known legitimate number or to another known email address.  It was only learned later that the legitimate party’s email was hacked, so verifying through the hacked email would not work!