Misspelled invoice email claims to be looking for payment but steals confidential information instead.