When you open up an email check to see whether or not its from a public email domain (ie. @gmail.com).
If it is from a public email domain, it is most likely a phishing attack as organizations do not use public domains.
Rather, their domains would be unique to their business (ie. Google’s email domain is @google.com).
However, there are trickier phishing attacks that use a unique domain.
It’s useful to do a quick search of the company and check its legitimacy.