It's phishing. Sure, you're going to check the url. But most people won't. And simply being on the bank is going to be validation enough for most.