Re: A bit more protection for the black hats
Lets say:
the email is from natwestbankonline.com
it is addressed specifically to you
all the sender headers match
however, you aren't entirely convinced it comes from Natwest Bank.
You can check whois, and see that it is registered to a domain privacy service, whereas the more familiar natwest.com is registered to National Westminster Bank plc at their registered head office.
You can conclude that it is not a genuine email.