In my experience, banks and other online institutions have spent years training their customers to fall for phishing attempts by sending legit emails with embedded links. People take it for granted that emails coming into their inbox that contain links to login pages really are from their bank, because that's how their bank behaves normally.