Attackers may gain access to a legitimate email account through a stolen password, or they may create an email address that closely resembles a genuine one.

Once they have established credibility, they often send urgent requests for payments, bank detail changes, invoices or confidential information, hoping the recipient will act without verifying the request.