You look closer at the sender’s email address and discover it mimics a well-known domain but has a single character off.
A classic spoofing tactic. You document the details for reporting.
"Cybercriminals count on your eyes skipping over the fine print."