typically an attack targets specific employee roles within an organization by sending a spoof email (or series of spoof emails) which fraudulently represent a senior colleague (ceo or similar) or a trusted customer. the email will issue instructions such as approving payments or releasing client data. the emails often use social engineering to trick the victim into making money transfers to the bank accounts of the fraudster.