My criterion is simpler: If the sender address looks wrong, it probably is. I then delete it, marking it as a scam.