Back when I had my bank card used fraudulently I had to fill out and sign a document online for the two charges they didn't catch in time. This couldn't just be done at their own chase.com website, though; the agent on the phone had to send me an email with a link to a site to do it, which was something like chase-sdx.com or something. Uhh, what? Secure Document Xchange. .... okay, whatever.
Fast forward to today, I just got an email from Chase asking customers to be part of a 'Customer Panel' (to participate in surveys related to their products and services). It's from Chase's email notify subdomain (they got that part right at least) but almost all the links go to chasepanel.com. The only reason I suspect it wasn't forged is that they have my full name and last four bank account digits in the email.