The simple rule is that your bank will not e-mail you a form to fill in, and certainly won't ask for passwords etc in one.
Most banks (and other financial sector companies) will hardly email you anything more than a generic invitation to login to their website to see whatever they have to say to you.
The risk of interception and falling foul of the regulator and data protection means they hardly send anything more than a generic message about anything these days.
Which is a good thing in my opinion.