Exercise 1: Why the Link Mismatch Is the Most Reliable Technical Tell — Possible Solution ==================================================================== WHAT THE EXAMPLE SHOWS ------------------------------ Per this chapter's code block, the button's visible text reads "https://mycompany.com/reset-password" while its actual `href` attribute points to "http://mycompany-secure-login.ru/reset.php" - two completely different domains, with only the visible text made to look legitimate. WHY THIS TELL IS MORE RELIABLE THAN THE OTHER RED FLAGS ------------------------------ Urgency, a generic greeting, and near-right branding are all *judgment calls* - a genuine, legitimate email can occasionally be urgent, and some real organizations do send generic greetings. The link mismatch is different: it's a directly checkable fact, not a matter of interpretation. Either the href matches a domain you recognize and trust, or it doesn't - there's no ambiguous middle ground the way there can be with "does this email feel a bit off." WHY IT'S ALSO THE EASIEST TO CHECK ------------------------------ Per this chapter, this gap is checkable "by hovering over the link (or reading its raw HTML source) rather than clicking it" - meaning the check itself carries zero risk. You never have to visit the suspicious destination to find out it's suspicious; the mismatch is visible before you commit to anything. WHY THIS COMBINATION MAKES IT THE STANDOUT TELL ------------------------------ A tell that is both objectively checkable (not a judgment call) and safely checkable (no risk in the checking itself) is strictly better than a tell that requires interpretation or exposes you to risk to confirm. That combination is exactly why this chapter singles it out as "the single most reliable technical tell" rather than just one item in the general list. WHY THIS WORKS AS AN ANSWER ------------------------------ It identifies the specific mismatch from the example, explains why it's objectively checkable rather than a judgment call, and explains why it's also safe to check - the two properties together are why the chapter ranks it above the other red flags.