People will also follow re-key instructions taking them to phishing sites. They'll tell strangers their passwords and download and run unique video codecs (aka malware) to watch some special comedy video file they've been sent by a friend. The answer is to educate your friends, family and any stranger who will listen to perform some critical analysis on an unsolicited approach by e-mail, phone, sms, or whatever.

Well, the obvious if somewhat facetious answer here is "the URL to log in." Another, less facetious one is "a password reset link." But even if we accept that expecting customers to follow long lists of directions without error is remotely reasonable, it doesn't matter because scammers are certainly not going to be fastidious about avoiding links, so by avoiding them yourself, you are only making it more convenient for your customers to get scammed than to actually do business with you.

I can see the value in not blindly visiting URLs received via email. I do not see the value in refusing to send links via email. Unless you yourself are a scammer, making people do error-prone extra work to access your site does not protect anyone from getting scammed.