I've fallen just once for a good phishing email that looked just like my PayPal usual drivel; but when I went to the fake site, LastPass would not recognize it, and of course that prompted me to look closely at the URL and discover, much to my embarrassment what I had done. I've never seen as convincing an email since; but I still look at headers once and a while even on the legit ones.