One thing I would pass on is that when an e-mail looks to be fairly credible, perhaps even using your name and some personal details, let your cursor hover over their email address. (on PCs)
If it's a genuine company or contact, you'll see the address you know ([email protected] for instance).
If it's not, you'll see something like [email protected]
MissAdventure banks here in NZ usually contact clients via the client's personal page, not by text, email or phone for just these very security reasons.
The personal page has to be accessed by login and password and the site itself is secure.
If, in an emergency, they must phone they ask you to go to the secure site for details they won't divulge on an insecure line.
I've got another 'keen'... Ouch!