Well, the obvious if somewhat facetious answer here is "the URL to log in." Another, less facetious one is "a password reset link." But even if we accept that e

Well, the obvious if somewhat facetious answer here is "the URL to log in." Another, less facetious one is "a password reset link." But even if we accept that expecting customers to follow long lists of directions without error is remotely reasonable, it doesn't matter because scammers are certainly not going to be fastidious about avoiding links, so by avoiding them yourself, you are only making it more convenient for your customers to get scammed than to actually do business with you. I can see the value in not blindly visiting URLs received via email. I do not see the value in refusing to send links via email. Unless you yourself are a scammer, making people do error-prone extra work to access your site does not protect anyone from getting scammed.