Virtually all of these things are spoofed - the return address is false - which makes them almost ompossible for an amature to deal with effectively. Phishing attacks (please verify your credit card/banking information requests) are worth reporting if you see them within a few hours of their arrival. Go to the message or view menu and choose 'show complete headers', then foreward the whole thing to abuse (or security) @ whateverthecompanywebsiteis. If nothing else, the company can close the receiving site.

Always send complete headers if you're going to report something. Occasionally, an expert can track them down. I think sam spade has a tool that helps decipher headers.