Very similar to if you were to send a traditional paper letter in an envelope with a stamp, and put an incorrect return address on it. You could even make it look exactly like something the real company would have sent. There is no validation of the return address. If the recipient were to respond to the return address, it would expose the ruse. The scam is that the contents of the letter have further instructions that lead to the scam.

Another complication is that the From address in internet email contains an address part and a description part. The address part is what is actually used to route the email, and the description part can be anything, including something that looks like an email address that doesn’t match the one in the address part. Most email clients only show the description part and hide the address part.

For example:

From: “Bob Smith” <bob@example.com>

From: “robert@somewhere.com” <bob@example.com>

From: "Do not reply" <noreply@example.com>

From: “quickbooks@notification.intuit.com” <scam@attacker.com>

Edit: formatting