I'm an IT consultant in NYC, and no fewer than 5 of my clients have been targeted by such scams. Information on the structure of their company is gathered from their website and an email will be fabricated appearing to be a conversation between company president, controller, CFO, etc all with their real names and email addresses, sent to a company accountant or something requesting a wire transfer.

The final email will be sent from a very similar email domain: the scammers register a domain with a simple letter/number substitution that is VERY difficult to visually detect if you aren't looking. Many were registered with VistaPrint, who offer free registration of domains on a trial plan, or something. You can see a list of their recently-registered domains here http://vistaprinta.tk/, if you scan through it you'll see some misspellings and l/1 switcheroos. (I spoke with someone at Vistaprint who indicated that they are actively working on this problem, and they have taken quick action when requested).

When my clients ask me to take a technology approach on these matters, I encourage them to treat it as a process issue instead. Having adequate controls for issues like this (phone call required, second approver for large wire transfers, etc) is better than any futile spam-blocking action we could take.