I work for a small-ish but fast-growing municipality, and we’re getting increasingly well-targeted actual attacks. Instead of posing as “The IT department” they’re posing as my boss or the City Manager by name.
This week they even started name-dropping the conference most of the directors were actually attending as an excuse why we wouldn’t be able to reach out and talk to them before the "request$ was due.