https://arstechnica.com/information-technology/2022/08/im-a-... has a good example of how sophisticated phishing attempts can be. Even for less sophisticated messages, they can cast a really wide net and just need to find someone on a busy day with an urgent request from "their boss".