Yes. It’s happened to me and it is a head fuck. The email was from a business with a perfectly legit email address.