The method the attacker employs is to gather as much information as possible about the target. This could include email address, names and other information about the individual person.
Always be cautious when receiving unsolicited emails or messages asking for personal information. Legitimate organizations typically do not request sensitive data via email.