I had the two factor authentication email yesterday from BA crm address. It displays my membership details so I guess it’s legit. I don’t tend to click through on marketing emails regardless other than verification links.