Hi Elie,
Unfortunately this is a pretty common tactic for scammers. Here are some ways they can do this.
1) The scammer can create a free online email account, and use the employees name as their display name. In this scenario, you would receive an email that may look like it comes from the employee, and would have their name in the email field, however if you hover over their name you may see the email address is not from the employees actual address.
2) The scammer may be using a more sophisticated method to spoof the email address of the employee, and in this case both the display name, and actual email address is shown, which adds to the deception over the previous method. In this scenario, the EOP or similar protection can help mitigate this.
3) The scammer may have compromised the employees email account, and are sending emails directly from the employees compromised account. If you have confirmed this is the case, then the employee will need to change their password imminently. If not done so already, it is recommended to also enable Multi-factor Authentication for the entire organization.
Hope this helps.
Regards,
David
