legit email?

Check your purchases history.

Purchase History Review

Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address.  The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple e-mails will never contain an attachment. Apple will never request personal information such as Social Security numbers.

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

It is a phishing attempt, with a key clue being the “Dear Customer”. Do not respond. Do not divulge any personal or financial information. You can use the address below to forward the suspect email message, as an attachment to Apple.

reportphishing@apple.com

The link below has information to help identify fraudulent emails.

https://support.apple.com/en-us/HT204759

Yes, also a scam message.

No. Apple will never refer to you as Dear Customer nor do they check on you for unusual activity.