A favorite option is to impersonate law enforcement agencies, and pretend the victim will get arrested if not paying.
Usually, this happens with the help of fraudulent domain names created only for the email address. But there are also exceptions, where a fake website shows content used to convince the victim that he / she is really under investigation.
An example is FBI Inspection Unit, active from the fraudulent domain name fbiinspectionunit.com.
The fraudulent domain name is part of a list posted by the real FBI last year in November on https://www.ic3.gov/Media/Y2020/PSA201123:
Spoofed FBI Internet Domains Pose Cyber and Disinformation Risks
The Federal Bureau of Investigation (FBI) is issuing this announcement to help the public recognize and avoid spoofed FBI-related Internet domains. The FBI observed unattributed cyber actors registering numerous domains spoofing legitimate FBI websites, indicating the potential for future operational activity. The FBI's main official website is www.fbi.gov. (See appendix for a list of identified spoofed FBI-related Internet domains.)
Spoofed domains and email accounts are leveraged by foreign actors and cybercriminals and can easily be mistaken for legitimate websites or emails. Adversaries can use spoofed domains and email accounts to disseminate false information; gather valid usernames, passwords, and email addresses; collect personally identifiable information; and spread malware, leading to further compromises and potential financial losses
Cyber actors create spoofed domains with slightly altered characteristics of legitimate domains. A spoofed domain may feature an alternate spelling of a word, or use an alternative top-level domain, such as a "[.]com" version of a legitimate "[.]gov" website. Members of the public could unknowingly visit spoofed domains while seeking information regarding the FBI's mission, services, or news coverage. Additionally, cyber actors may use seemingly legitimate email accounts to entice the public into clicking on malicious files or links.
The FBI urges all members of the American public to critically evaluate the websites they visit, and the messages sent to their personal and business email accounts, to seek out reliable and verified FBI information.
RECOMMENDATIONS
Verify the spelling of web addresses, websites, and email addresses that look trustworthy but may be imitations of legitimate election websites.
Ensure operating systems and applications are updated to the most current versions.
Update anti-malware and anti-virus software and conduct regular network scans.
Do not enable macros on documents downloaded from an email unless absolutely necessary, and after ensuring the file is not malicious.
Do not open emails or attachments from unknown individuals. Do not communicate with unsolicited email senders.
Never provide personal information of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate.
Use strong two-factor authentication if possible, using biometrics, hardware tokens, or authentication apps.
Use domain whitelisting to allow outgoing network traffic to websites that are deemed safe.
Disable or remove unneeded software applications
Verify that the website you visit has a Secure Sockets Layer (SSL) certificate.
VICTIM REPORTING AND ADDITIONAL INFORMATION
The FBI encourages the public to report information concerning suspicious or criminal activity to their local field office (www.fbi.gov/contact-us/fieldoffices) or the FBI's Internet Crime Complaint Center (www.ic3.gov).