It seems that no one's identity is immune from theft, including financial regulators.  Last week, the California Department of Financial Protection & Innovation announced that it received a complaint from a California resident regarding an email sent by someone purportedly from the DFPI.  As described in the DFPI's announcement, the scam does not appear to be very sophisticated.  However, the internet allows fraudsters to cast their net very widely at very little marginal cost.  Thus, snaring even a few fish can be profitable.  

When I served as Commissioner in the early halcyon days of the internet, one company actually paid someone to conduct a fictive in-person examination.  They forged Department of Corporations business cards and an examination report.  As Qoheleth wrote long ago: "The thing that hath been, it is that which shall be; and that which is done is that which shall be done: and there is no new thing under the sun".  Ecclesiastes 1:9.