Found a mail purporting to come from Amazon concerning a refund, on a secure work email account.
Spotted as fake immediately as the @(domain) part of the address was spelled amazom.
What I can't fathom is how this address was harvested.
it was only used for work mails, and I have never signed into Amazon on the system concerned.
Sent a report in and deleted it, but it is still a puzzle to me.