Yeah...speculating...an email from from supposed "coinbase support" or "ledger support", perhaps.
Albeit, this is not "advanced".
Advanced probably would be someone impersonating a third party where victim wanted to contribute his coins (like an investment fund, etc.) or something like this.
A cautionary tale.