From time to time, we all receive emails which purport to be from Apple, but are in fact phishing attacks, or scam.
Apple has an email address which they invite us to send such messages: email@example.com. Please ensure that you send the message as an attachment, e.g. using the Forward as Attachment command in the Message menu of Mail: that should provide them with the full Internet headers, which may allow the attack to be traced.
Full details, and other support info concerning security and Apple IDs, is here.
Thanks to Susie Ochs and Christopher Phin for drawing attention to this.