If it's an unexpected or strange email, call (don't email) the sender to confirm before clicking any link