Yay for third-party email services that From: be a no-reply address from an entirely different company (and therefore only authenticity validation for that company), and a Reply-To: to some obscure mailbox from the supposed sender. I'm sure that makes perfect sense to most people.

> So the rule of "don't click links in emails" is the only foolproof rule.

The only truly foolproof rule is "don't open emails". Also helps a lot on mental health and associated expenditures!