If you’re being phished, you need to be able to identify the sender. If it’s allegedly from a company or government service, contact that service directly to verify the authenticity of the email.