Identifying legitimate emails from the iTunes Store - http://support.apple.com/HT201679 - lacking in specifics, the next link is better:
Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - https://support.apple.com/HT204759
Forward attempts as an attachment to: reportphishing@apple.com
https://blog.malwarebytes.com/cybercrime/2018/02/panic-attack-apple-scams-apply- pressure/
Apple e-mails address you by your real name.
Apple e-mails originate from @apple.com or @itunes.com
Mouse over links to see if they direct to real Apple web sites.
View, change, or cancel your subscriptions - https://support.apple.com/HT202039 - "Your membership or subscription might renew if you don't cancel your membership or subscription more than 24 hours before your renewal date." At this stage the renewal is considered a purchase. For a new subscription the sale is probably effective from when you first agree to subscribe. Deleting an app does not cancel the subscription if it has one.
If you see ‘itunes.com/bill‘ or an unfamiliar charge on your bank, credit card, or debit statement - https://support.apple.com/HT201382 - "Before you contact Apple to request a refund for a charge you don't recognize..."