Yes — only one rule. NEVER.

Never click any link in an email that is asking you to log in, change your password or do anything with regard to an account.

If you are concerned because the email looks legit (very seldom) then log in to the site directly from the URL you usually use and change your password.