My advice here is pretty standard: If you get an email that requires an action, go to the website directly. Don't click any links.

It adds friction, but does solve the problem. For banking/systems, I'd much rather have the friction.