Or the email is rendered HTML, where the expected URL is used as the text for an anchor whose href is the malicious site.

Pro tip: Hover over the link an check the URL. Or look at the source.

I don't click the link. Simple.

Track someone else.