Phishing gets more personal and harder to detect February 12, 2019 https://betanews.com/2019/02/12/phishing-personal-harder-to-detect/ INKY's 2018 Q4 Email Security Report (PDF): https://cdn2.hubspot.net/hubfs/4660171/4Q18%20INKY%20Phishing%20Report.pdf
So just don't do anything serious without telephone confirmation. Using a number that you knew already.