This phish falls into the 'social engineering' category. It is well designed, and relies on its persuasiveness, rather than on technical tricks.

The email looks nice:

This is what the 'social engineering' approach is all about - make the whole thing as close to the real one as possible, so the potential victim does not notice the small details that expose the scam.

After eventually 'signing in', the main phish page opens:

There are a couple of things to pay attention here, too - the URL remains the same as it was on the first page. And even when it's cleverly chosen, the vigilant can still find it suspicious.

The second thing is the fact that the site is not a secure one. Remember, legitimate institutions always use secure sites to transfer sensitive information. The browser indication of being in a secure site is a padlock icon in the right part of the status bar. It is missing in this case:

The main protection against such scams is the increased level of awareness and vigilance from the user side. Small details (like the suspicious URL and the missing site security) indicate a big scam.