The bottom line is that you should always check the url where they ask credentials. With anything Google it should be accounts.google.com. But even that is not bulletproof as they can register domain names using similar unicode characters (like using alpha char instead of a)
RE: New Phishing Alert: Fake Email Appearing as Google Support