Don't know the details here, but email is still very much broken, and a number of large companies, including in the financial sector, are spoofable even after checking the usual boxes.[0]

[0]: https://news.ycombinator.com/item?id=37438478