This could only be achieved with JavaScript (you can set the link to anything, and then write an onclick action that sends the user somewhere else).

But if you allow JavaScript to be executed by your browser based email client, you are vulnerable to persistent XSS, which means that you have bigger problems.

_{As an aside, telling users to do [inconvenient thing] will almost never work as security mechanism. A better solution would be to strip out all a tags and substitute the actual link instead.}

This could only be achieved with JavaScript. You can set the link to anything, and then write an onclick action that sends the user somewhere else:

<a href="http://example.com" onclick="window.location = 'http://www.google.com';return false;">click</a>

But if you allow JavaScript to be executed by your browser based email client, you are vulnerable to persistent XSS, which means that you have bigger problems.

_{As an aside, telling users to do [inconvenient thing] will almost never work as security mechanism. A better solution would be to strip out all a tags and substitute the actual link instead.}