@staticsafe my general rule of thumb (and the advice I give out) is; if <company> is asking you to do something in said email and you're not expecting it (e.g. pw reset), it's probably fake. If you're not sure, contact them via other means - live chat on site, contact form, email direct etc.