You’d expect a phishing scam to be riddled with typos or strange email addresses. But one new scheme is anything but sloppy.