What confused me was the email address it came from looks like a valid email. I was under the impression you could make anything look like a genuine email from X company, but you always failed at the email address. "DHLParcelTracker@hotmail.com" for example (or all the Neopets Team emails I get subjected to asking for my password and pin).

I just didn't think malicious emails could be sent from real companies.