The entire goal of phishing emails is to get you to act quickly.

Anytime you are asked to download or clock through, your immediate reaction ought to be to call (the number on your card, not a number listed on the email).

If by some chance this happened to be a poorly-done but legitimate requirement, you would then learn that from your call.