I had 2 of these last week , one from PayPal , which was a transaction receipt saying id made a payment of 150 pounds to some company and the other one was from the tax office, telling me they need me to login with my debit card details ready to receive my refund lol, both looked legit and someone who didn't know any better would have clicked on these links , luckily AVG scans my emails and killed what ever code was in there and put a tag next to it to notify me