Your inbox could contain real money—or a trap. Here's how to tell a legit settlement notice site from a data-stealing fake.