Two thoughts regarding any kind of message/email/phone call etc.
1) Is its real and possibly an issue for concern.
Click on this link "If you think your Apple ID has been compromised" --> https://support.apple.com/HT204145
'Checklist: If you want to see if anyone else has access to your device or accounts' click here --> https://support.apple.com/HT212021
Security and your Apple ID - https://support.apple.com/HT201303
Contact Apple for help with Apple ID account security - https://support.apple.com/HT204169 "This article provides country-specific Apple Support contact information for customers seeking help with their Apple ID password or other security-related issues." Better for directly reporting an issue.
2) It is phishing, particularly if it has any kind of link it wants you to click on to help "resolve" this.
Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. Here are some guidelines:
Identifying legitimate emails from the iTunes Store - http://support.apple.com/HT201679
Recognize and avoid phishing messages, phony support calls, and other scams - https://support.apple.com/HT204759
Apple 'How to identify, avoid, and report phishing' video--> https://youtu.be/SR3Z3fXXjfw
If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Try to independently verify the resource by going to a support page on apple.com and use that to contact Apple or to use the service the message is telling you to use.
Forward email attempts as an attachment (in MacOS Mail use the paperclip icon) to: reportphishing@apple.com then delete it.