Three clients hit by "someone changed the bank details on an email" fraud, over £2m diverted and lost. Are you safe?