It's fake.
Identifying legitimate emails from the iTunes Store - http://support.apple.com/HT201679 - lacking in specifics, the next link is better:
Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - https://support.apple.com/HT204759
Forward attempts as an attachment to: reportphishing@apple.com
https://blog.malwarebytes.com/cybercrime/2018/02/panic-attack-apple-scams-apply- pressure/
- Apple e-mails address you by your real name, not something like "Dear Customer" , "Dear Client" or an e-mail address.
- Apple e-mails originate from @apple.com or @itunes.com but I think it is possible to spoof a sender address
- Mouse over links to see if they direct to real Apple web sites. Do not click on them as this just tells the spammer they have a working e-mail address in their database.
- Phishing emails often threaten you to scare you into doing something without thinking.