The banking giant was targeted in a 'sophisticated external impersonation scam'