https://www.tedcromwell.com/blog/that-pending-paypal-charge-email-is-a-scam-even-though-it-really-came-from-paypa "The old advice — "check the sender's address," "look for typos," "hover over links" — is no longer enough. Scammers have learned to launder their messages through real, trusted services so that every traditional red flag turns green. The sender is real. The links are real. The branding is real. Only the *story* is fake, and the story lives in places your spam filter doesn't look. The defense, increasingly, is a single habit: when an email tells you something alarming about an account, don't respond to the email. Go to the service directly, on your own, the way you always do. If something is really wrong, you'll see it there. If you don't see it there, the email was lying."