A common trick is an email warning of a suspicious login, with a convenient button to 'secure your account' that leads to a fake login page. Check such alerts by visiting the site directly, never through the email's link.
“The 'secure your account' button can be the attack itself.”