Someone pretending to be the CEO emails the CFO, CFO makes the payment. As mentioned they usually compromise the email system first and look for similar requests, this way they know what sort of format the CFO is expecting and the figures that they deal with, try to make it look as usual as possible.