A common factor in most social engineering attacks like this or phishing emails, is *a sense of urgency*. What I tell people is that any sense of urgency should automatically make you suspicious. If someone is trying to get you to act *immediately*, they are attempting to short circuit your common sense. Nothing is so urgent that it can't wait 5-10 minutes for you to verify the facts.