Reset password email

 The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple e-mails will never contain an attachment. Apple will never request personal information by email such as Social Security numbers, your Mother’s maiden name or full credit card numbers .

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams

Identifying legitimate emails from the iTunes Store

Send the e-mail to Apple as an attachment to a new e-mail before deleting it. You can forward as an attachment by going to Mail/Message/Forward as attachment. You won’t receive a response.

reportphishing@apple.com

If the e-mail do not address you with your Full Name, it's 100% scam.

Apple has your details on file and will always address you with your Full Name,

not Dear Customer, Dear Client, Dear Apple User, Dear your-email-address, ....

You're welcome.

Have a read here: Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - Apple Support

Be vigilant.