Clicking a link shows an attacker several things: * That their attack was delivered successfully to inboxes. * What email addresses are live. * Who is cu

Clicking a link shows an attacker several things: * That their attack was delivered successfully to inboxes. * What email addresses are live. * Who is curious enough that they will investigate. * Who believes they understand and can handle the risks. These are not small things for an attacker to learn. Further, in a world where drive-by browser attacks are real, it's worth thinking very carefully if clicking a link in a phishing email should be regarded as essentially harmless.