Law firms and charitable organisations were targeted in a major email scam, leading to a 10-month police investigation.