If legitimate companies didn't do this, then the email would be suspicious.