You can't say this as a hack. This is social engineering. People must do their due diligence before sending their funds. If emails didn't come from @experty.io domain then it is fraud. Common sense