I always double check the email address that is sending removing whatever filter my email client is using to replace the address with a name “for convenience sake”. That will usually tell me if it’s a legit email or some kind of spam/phishing. And if it is a legit addy and it still seems too suspicious I will generally contact the person who sent it to top them off that their address may have been compromised. Generally speaking this tends to cover all of my bases.