NYC firm handling lux properties allegedly scammed out of $19M — thanks to single phishing email

The “spoofing" email led to the gargantuan sum getting accidentally transferred to a TD Bank account posing as the Battery Park City Authority, according to sources with knowledge of the situation and internal correspondence.