Before opening a link, check whether the sender and the request make sense. Unexpected urgency, unusual attachments, and mismatched web addresses are common warning signs.
Protect your account with a unique password and multi-factor authentication where available. Keep your recovery options current.
When in doubt, contact the organization using a website or phone number you already trust rather than replying to the message.