There are many spoof emails out there immitating large corporations at which the target will most likely have an account. The From of the address tells you absolutely nothing about where it actually originated. Anyone can send an email with anyone else's name in the From field.
The only real way to tell is the links in the email. BUT, the link you are shown is not necessarily the actual underlying link. You also have to watch out for a similar but different URL.
Now, here is something important to understand. Many sites have subdomains. A subdomain is subdomain.maindomain.com. The trick is to understand that the part that comes before the .com is the main site. What comes before that is just categories on the main site. For example: checkout.paypal.com, if that exists, is a page or folder on paypal's site. However, paypal.hkjvg.com is most likely a hacker trying to fool you. The site is hkjvg and paypal.hkjvg is a page he set up to get you to enter all your paypal information for him to binge.
If an email is suspicious, you are better off not even openning it because when you do, it will verify you as a real address. It does this by having a picture in the email with a unique file name just for you. When your email program picks up the picture your address is verified, hereby making you a steady and valuable customer. Online email will often not show or pickup tese pictures.



