I regularly get them from someone who is spoofing citibank. The email looks very official, the site it links to is on a very plausible domain name, the only giveaway is the content (it asks for private information via email, which a bank would never, ever do) and the address ends in something other than .com. I also get an email from 'eBay' asking me to go to this site and 'confirm' my account information. Very convincing if you don't know how SSL works, but still fake.