Unless the sender was spoofed, this is legit.
Also how is this phishing, if they do not prompt you to log in to a fake site where they phish off your credentials? You do have an account that sells things and did fill out some tax survey things, did you not?
If you still have the mail, you can scrutinize the links in that mail and the mail headers. And is the pdf not attached, as the mail says? Use one of the dumb pdf readers that cannot be hacked to open it.