I recently got a very official looking email from my bank with a link to fix a security problem. When I hovered over the address in the link (not pressed on it) I was that the address was not quite right. It was close but the suffix was for a foreign country. I deleted the email. A few months ago I got a legitimate email with a similar link. I did not use the link, but I signed into the site and fixed the problem. I also called the company and complained about live links in an email!