How should | confirm if a request is legitimate?

Click the senders link to see if it takes me to a legitimate website

Reply to the email to confirm the senders identity

Contact the sender through another medium (e.g. in person,phone etc)