It can start with a phone call that sounds like a loved one, or maybe it's an email that looks like it's from your bank.