Do not reply: Even if a message appears to be legitimate, users should understand that no reputable company would ask them to share usernames, passwords or any sensitive or confidential information such as credit card or social security numbers via e-mail.