Phishing is a type of social engineering attack that is used to steal a vicitm's credentials. Making a fake email is probably one of the most effective phishing attacks against commercial enterprises. It always baffles me how people can fall for it!
Yes, that email is a phishing attempt...They should call the bank to verify.
The best way to tell is by looking at who sent you the email and who is CC'd to it. Also, the title of the email might be a dead giveaway...