I've accidentally executed this tactic on myself - no red flags were raised and funds were received.

Being owed a sizable wire from a corporate entity, I requested payment to an account via my personal email (<name>@<name>.co). As they were validating/processing that, I opened up a new bank account that can receive wires with no fees. I then sent them an email with the new information, and a couple weeks later received the funds in my new bank account without any friction. What no one brought up was the fact that the email with the new information was from <name>@<name>.com, as I had transitioned from .co to .com in the meantime. The attack vector highlighted in this article is definitely under-guarded.