@kim_harding that fake package one has come pretty close to getting a click out of me before even though I knew that scam well. I just happened to be waiting for an urgent package that day.
The latest phishing attempts I'm seeing are terrifying in their sophistication. I saw one that used a real Facebook domain in the From address. It passed SPF checks because they managed to get it sent from a Salesforce server instance that Facebook has listed as an approved sender.
I manage an Eventbrite account and for an event we published an email address. A week after the event is completed, we start getting fake Eventbrite emails to that published address informing us that we need to resubmit correct tax information or our event funds would be frozen... which was actually the case. Our funds were indeed frozen for incorrect information. I was only able to easily pick it out as fraudulent because the email address we used as the event info address isn't associated with our account on Eventbrite.