Facebook typically uses addresses ending in “@facebookmail.com” for its security emails, but as you know, phishers can spoof accounts and make their messages look legit. If you miss the flaws and irregularities that usually give phishing schemes away, such as spelling and grammar mistakes, then you really might fall victim to them. Of course, you’d have to make sure you’re visiting the real Facebook website whenever you want to access the list, so you’ll still have to make it a habit to open a fresh tab and type the URL yourself.
Found an email not in the list? Facebook is encouraging you to report it to phish@fb.com.