It's probably a scam. Ways to tell:
1. Real emails from Apple are addressed to you by name, not 'Dear Customer' or something like that.
2. Real emails from Apple are sent from the .apple.com domain, never from @icloud.com or any other address (though 'From' addresses can be easily spoofed).
3. If the message includes a link to 'verify' or some such, hover your mouse over it and you will see a tooltip giving the real address - probably not an @apple.com one.
In any event never follow links in such messages. If you want to change your password or make other adjustments go directly to http://appleid.apple.com .
You can report scam emails to Apple by forwarding them as an attachment to reportphishing@apple.com .