Legitimate institutions that send out emails to their customers usually send them from an email address thats associated with their web site. In this message, the email address ends with @online.com. Thats your first clue that this might be a phishing email, because the message claims to be from Capital One.