Phishing training companies will actually use this tactic (they call it 'double barrel'), which makes me think that real phishers are already doing this, too. W

Phishing training companies will actually use this tactic (they call it 'double barrel'), which makes me think that real phishers are already doing this, too. What I think would be better is an email that said to go log into your account to complete the confirmation, instead of following any link in the email itself. It's less convenient, but it's not something that phishers would tell you to do.