The most frequently used method is to send a spam email or instant messages to many people with a malicious link. The spam email is designed in such a way so as to look exactly like an email sent by a legitimate company or bank.
The email may ask the recipient to click on a link and provide confidential information. Different techniques can be used to trick the recipient viz. validation of account information, threat of account suspension, notice form Income tax department, etc.