That sounds like a scam. If you use webmail to access your Comcast email, check for the Xfinity Verified Email logo for any message claiming to be from Comcast/Xfinity -- see https://www.xfinity.com/support/articles/comcast-verified-email.
You might also check with customer service using the phone number printed on your bill, 1-800-Xfinity (1-800-934-6489) or 1-800-Comcast (1-800-266-2278), or one of the methods listed on the official "Contact Us" page at https://www.xfinity.com/support/contact-us/. Better yet, call Comcast Security Assurance. You can reach them at 1-888-565-4329 (from https://internetsecurity.xfinity.com/help/report-abuse/).