The original message:
What gave it away:
The only thing in the email that is concerning is the request itself. There is nothing to peg this as a malicious email. It looks completely legitimate and innocent. The sender’s email even looks correct. However this is a phishing email, the email address has been spoofed.
If you aren’t sure if it is legitimate:
Confirm with the sender that they made the request.
Search terms – payroll, deposit, update, process