In more detail
Attackers exploit trust, urgency, fear and helpfulness: a caller claiming to be IT support, a fake invoice, a "boss" asking for gift cards. Phishing is the best-known form. Defences are verifying requests through a second channel, a culture where it is safe to say "let me check", and processes that do not rely on a single person's judgement.