Email looked legit, I didn't click anything in the email, except when I cashed out, to freeze the account, I did it from the desktop away from where the application was, because I was not sure if the phone was infected. Either way, after I cashed out, I logged out, and tried to log back in, it told me incorrect password, so that confirmed to me that those 2 emails were in fact legit, and one thing for sure, I did not make the request for change. So that new application has to be the issue at hand.