Your employee receives an email from Amazon or UPS. They click on the embedded link, thinking they’re following it to track a package. When it won’t open, they shrug off the oddity and delete it.
Sometimes it’s not an email. Instead, it’s a banner ad telling your employee that they have a virus and need antivirus software. When your employee clicks, nothing happens once again, and they think little of it.