I had a client involved in a scam - email got hacked and hackers started emailing his contact list. One of his close friends was talked into wiring $50,000 USD. Authorities were completely impotent in the whole process. The money was just gone.

This is also why I now force my clients to sign a waiver if they don't wanna use MFA for email.