You receive an e-mail message informing you of the need to go change your password, and a convenient link to the necessary settings page is provided right on the message. This link goes not to where you are being told it does, but to a lookalike page that delivers your information to the criminals.
The safe solution is simple: Take the alert seriously--don't even bother considering the other alternative. However, use the links you should have entered into your own address book software for that institution or web service. In this way, you use your IQ to divert _bad luck_ away from yourself (and, alas, toward other people).
I wrote "timely" because this is apparently the technique that got [someone] into Democratic e-mails during the period before the 2016 presidential election.
• New York Times <http://www.nytimes.com/interactive/2017/01/06/us/russian-hack-evidence.html>
• Wikipedia <https://en.wikipedia.org/wiki/Phishing>
I have said this before: Most of us have lived our entire lives in neighborhoods (both our domiciles and our retail and other business activities) in places where criminal activity was more a matter of news reportage than of experience. Now the criminality--the actual threats--come(s) right into our homes.
Welcome to the constantly-connected future.
Mark_
06 January 2017 (a date that still seems like it belongs to The Future)