To illustrate just how creative phishing campaigns have become, on January 30, 2019, it was reported by multiple credit unions that Bank Secrecy Act officers at credit unions around the country received emails that appeared to be from Bank Secrecy Officers at other credit unions. The emails were addressed to the actual Bank Secrecy Officers of the credit union (the Patriot Act requires each credit union to designate two such officers) and stated that a suspicious transfer from one of its customers was on hold for suspected money laundering. The email included an attached pdf which provided detailed information about the suspicious transaction, and urged the Officer to open the pdf.

When the pdf was opened, it contained a link to a malicious site.

It was later reported that not only credit unions were attacked, but also other financial institutions, and the Financial Crimes Enforcement Network of the U.S. Treasury Department was urging financial institutions to be wary of them and delete them.

[View source.]