Yes, they can send legit-looking email with getexample.com, then people will accept those emails as trusted, such as lifecycle emails.

Then they send an invoice…