Someone in our family recently requested a password change for a website (Costco). Soon after requesting, they received an email with the standard "click the link below to reset", followed by a link.
They noticed that the email looked a little sketchy, so they had me look at it (after they had already gone through with the reset). I found that the link they clicked had the text:
https://www.costco.ca/ResetForgotPassword?token=[a token here]
But, when mousing over it, it showed the following (abbreviated) link:
http://email-tracking.infobip.com/tracking/1/click/[a different token here]
So the email was intentionally hiding where the link went.
To me, as someone who's trying to be security minded as I enter the field, this raised some red flags. I can think of three possibilities:
Since it was the legitimate Costco website (as far as I can tell) that initiated the request, they're deferring password resets to a third-party, and ironically trying to make the email appear more legitimate by masking the link (since
The website had been compromised, and they were phishing for email/password combinations, or potentially the ability to buy things on a victim's behalf.
Our/a DNS server is compromised and the website is illegitimate, for the same reasons as above.
Is it at all common practice for companies to hide legitimate links? I'm asking because this has always struck me as the kind of thing that I should be on the lookout for when assessing the legitimacy of an email, and this kind of throws a wrench in that thought-process.