Is it standard practice to hide where links point in a legitimate email?

Question

Someone in our family recently requested a password change for a website (Costco). Soon after requesting, they received an email with the standard "click the link below to reset", followed by a link.

They noticed that the email looked a little sketchy, so they had me look at it (after they had already gone through with the reset). I found that the link they clicked had the text:

https://www.costco.ca/ResetForgotPassword?token=[a token here]

But, when mousing over it, it showed the following (abbreviated) link:

http://email-tracking.infobip.com/tracking/1/click/[a different token here]

So the email was intentionally hiding where the link went.

To me, as someone who's trying to be security minded as I enter the field, this raised some red flags. I can think of three possibilities:

• Since it was the legitimate Costco website (as far as I can tell) that initiated the request, they're deferring password resets to a third-party, and ironically trying to make the email appear more legitimate by masking the link (since http://email-tracking.infobip.com looks sketchy).

• The website had been compromised, and they were phishing for email/password combinations, or potentially the ability to buy things on a victim's behalf.

• Our/a DNS server is compromised and the website is illegitimate, for the same reasons as above.

Is it at all common practice for companies to hide legitimate links? I'm asking because this has always struck me as the kind of thing that I should be on the lookout for when assessing the legitimacy of an email, and this kind of throws a wrench in that thought-process.

Answer 1

Yes and No.

The intent of this feature isn't to hide where the URL is pointing to, but to track clickthrough rate. Usually, links in e-mails are sent out for marketing purposes - 70% off for Black Friday, click >>>HERE<<< - that kind of stuff. And of course, the marketing department wants to know how high the clickthrough rate is.

Of course, the store could do that themselves, but it's much easier to just outsource it and have a nice, colorful panel that shows a neat graph, than something the IT department developed internally.

As for why the password reset link is sent this way is probably due to a misconfiguration. I am not familiar with the product InfoBip offers, but I assume somewhere in the settings, there is a checkbox like "Track all links" that results in all links sent out to customers being replaced by "trackable" links as described above.

To summarize, the point isn't to hide where the link is going, but to provide the company with a way to check clickthrough rate. The fact that this is done to a password-reset link is most likely an oversight.

Answer 2

Well it should be seen as a serious misconfiguration and should never occur on a professionally maintained site.

Unfortunately, most sites are managed by the communication or marketing service, with the help of third party contractors. And then anything can happen, either per simple mistake because a click counter was installed where it should not be, or because the contractor decided to constitute its own mail addresses database. And the internal site manager can neither detect it, not understand why it is poor practice.

The following is no more than my own opinion. When I see sites that visibly externalize whole or part or their client relationship, I do not trust them to respect the most basic confidentiality rules. Commands and related payment should work smoothly, because this is essential for them, but what happens with their customer data, only god knows. So I apply the essential rules:

• an email address that does not matter too much (not my primary email address)
• a dedicated password that will never be re-used on any other site

And if they insist on having personal data that I think they do not deserve I try to use another site. Unfortunately, it is hard to find a correctly managed commercial site...