Pro tip: I started checking the link text instead of the URL on emails, and it caught 3 fakes in one week
Last Tuesday I got an email from what looked like my bank at first glance, and the sender address even had the right name in it. The link said "log in to your account" but when I hovered over it, the real address was a random string ending in .xyz, not my bank's site. My coworker Dana told me she almost clicked it too, so I pulled up the header details and the reply-to was a totally different domain. Now I just look at where a link really goes before touching it, and I'm wondering how many of these slip past people who only check the display name.