Most BEC scams follow the same process, though the identity assumed by the attacker and their targets will vary.
Identity Research
Employee Research
Attack Prep
Attack Launch