First check that all of the links in the email are Bandcamp.com URLs before clicking them (you can do that by hovering over the links). Keep an eye out for typos or suspicious wording in the message, too. Bandcamp will never ask for your password, credit card details, or other private information in an email.
If you are visiting a real Bandcamp.com login or confirmation page, you will see a lock icon in your browser's navigation bar indicating that your connection to the site is secure. Secure Bandcamp URLs look like this: https://bandcamp.com/ or this https://example.bandcamp.com/.
To report a suspicious message to us, please forward the message to this address.