"Call: If the e-mail or Web site purports to be from a legitimate company or financial institution, call or e-mail that company directly and ask whether the e-mail or Web site is really from that company." . . . . .