The email is well-designed, has the right colors, and says your payment failed or your account was flagged for unusual activity. There’s a big button: Verify Account. The link takes you to a sign-in page that looks exactly like the real one. If you type your password, the scammer gets it. If you reuse that password anywhere else, they get those too.
This works because the pretext is so plausible. Cards do expire. Accounts do get flagged. The email isn’t asking for anything weird, just for you to sign in. The trick is in where sign in goes.
The giveaway is almost never in the email itself. It’s in the address bar after you click. Real companies don’t host sign-in pages on random domains.