Unfortunately, there are all sorts of ways to phish links. https://en.wikipedia.org/wiki/Phishing#Link_manipulation

The link may look similar or even appear identical, and still be under control of the scammer.

Similar to just not trusting incoming phone calls, you can't really trust incoming links via standard email, without some definitive way of validating the sender.