The original message:

What gave it away:

The only thing in the email that is concerning is the request itself. There is nothing to peg this as a malicious email. It looks completely legitimate and innocent. The sender’s email even looks correct.  However this is a phishing email, the email address has been spoofed.

If you aren’t sure if it is legitimate:

Confirm with the sender that they made the request.

 

 

Search terms –  payroll, deposit, update, process