It can be through a fraudulent request for personal information. Nobody asks for personal information by email. Bank and credit card companies do not do that.