The emails want you to click a link that takes you to a scam website that only looks like the official site — but it’s not.