I got an email saying there has been strange activity in my iCloud account. Email said they have locked my account and attached pdf has steps what to do.
Part of the pdf
"Sign In to your Apple ID and provide the requested steps to access your account. We'll verifying your information for
validation violating terms of agreement.
It's important that we notify you because it helps us prevent unauthorized persons to restore your access and for helps us
serve you better."
Bad thing is that the button in PDF is going somewhere else than Apple
Picture shows the link.
Also the email headers were little offX-Google-DKIM-Signature:
or Apple uses Gmail servers for sending email
There should be somehow to teach people how to check these basic things. I don't want to know how many people clicks the link and puts their credentials there.