1. IT Services will never ask for your password over e-mail.
2. IT Services will never ask for your password via a Google or Microsoft Form.
3. A phishing scam message can come from any e-mail account.    Any unsolicited message, especially one that includes a link or attachment, could be suspicious. You should not open attachments or click on random links in e-mails - especially if they are in messages you are not expecting. You can hover your cursor over links in e-mails to find out where they actually go - for example, a link to a Dropbox login page should take you to a dropbox.com page if it was legitimate, and not to web address you don't recognise (such as dropbox.xyz).  
4. You should not reply in any way to e-mail messages that request information such as your password, PIN, birth date, credit card and bank account numbers,  or any other sensitive information. No legitimate institution will ask for these details over e-mail. If you receive an e-mail directing you to a phone number or website to provide this information, do not use the contact information or links provided in the message. Instead, contact the institution using their officially published phone number or website and ask for instructions.