. . "If the email or Web site purports to be from a legitimate company or financial institution, call or email that company directly and ask whether the email or Web site is really from that company." . . .