A common factor in most social engineering attacks like this or phishing emails, is a sense of urgency. What I tell people is that any sense of urgency should automatically make you suspicious. If someone is trying to get you to act immediately, they are attempting to short circuit your common sense. Nothing is so urgent that it can't wait 5-10 minutes for you to verify the facts.