Or the email is rendered HTML, where the expected URL is used as the text for an anchor whose href is the malicious site.

Pro tip: Hover over the link an check the URL. Or look at the source.