Recently an organization I forgot to update credit card details had my renewal payment fail because I forgot to update details. They sent an email as below which had a direct link to a web form without any instructions to check authenticity. I think this is bad practice because it trains members to blindly accept direct links to update details which are similar to phishing emails.
I know this reduces membership renewal (as every additional step discourages signup as people are busy) but the email should ask users to go to the website from bookmarks or manually enter it in or ask users to internet search the organisation names (although this also has issues with scammers advertising scam websites).
The organisation's counter-argument was that a hypothetical nefarious cracker could put false instructions anyway.
What's best practice in this regards? Am I being too strict or nit picking?
Membership Payment Failed at <organisation>
The current subscription payment for your <organisation> membership has failed. Please click the following link to log in and update your billing information to avoid account suspension. https://<org domain>/wp-login.php?redirect_to=https%3A%2F%2F<org domain>%2Fmembership%2Fmembership-billing%2F
Account: <my username> (<my email>)