CP/SM hasn't been hacked - like the paypal ones we all get this uses a spoofed sender. Yes while perhaps more targeted than usual crud like the ones from 'your' bank, if you look carefully at these theres always pointers... It doesn't have your name on it. Theres no account details. The english, grammar and spelling is worse than mine :) The url to get your refund goes to a free file sharing service. The zip contains an .scr file.

Pinky - you left the lens cap of your mind on again.