How to cancel purchase?

Are you sure it is from Apple?

Learn how to identify and avoid fraudulent "phishing" email, fake ‘virus alerts’ and other scams:

https://support.apple.com/en-us/ht204759

How to report phishing emails to Apple:

These email addresses are monitored by Apple, but you might not receive a reply to your report.

• If you receive what you believe to be a phishing email that's designed to look like it’s from Apple, please send it to reportphishing@apple.com.
• To report spam or other suspicious emails that you receive in your iCloud.com, me.com, or mac.com Inbox, please send them to abuse@icloud.com.
• To report spam or other suspicious messages that you receive through iMessage, tap Report Junk under the message, or take a screenshot on your iPhone, iPad, iPod touch, or Mac and send it to imessage.spam@apple.com.
• If you receive a suspicious message about your purchase activity in the iTunes Store, App Store, or iBooks Store, contact iTunes Support.

Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address. The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple e-mails will never contain an attachment. Apple will never request personal information such as Social Security numbers.

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

Identifying legitimate emails from the iTunes Store