[M T]

Sarcasm aside, I expect this suggestion is for our own protection.  The concern is that the link points to malware and was posted by a bot that gained access to someone's authentication for this board.

I remind our users at my site never to click on a link by itself in a message, even from a friend.
The small amount of effort it takes for the sender to say something, anything, about the link gives the recipient a lot better feel about whether it came from the expected person or from some person or bot that gained access to his/her account.

You can still fall prey to generic messages ("Here's a joke you'll like"), but, so far, mostly the bad guys haven't even bothered. (If they include an English sentence, that would be a give away to the German recipients, etc.)  But, even if they did that with a library of a few hundred such generic messages, we would soon recognize this ploy.

[M T]

Sarcasm aside, I expect this suggestion is for our own protection.  The concern is that the link points to malware and was posted by a bot that gained access to someone's authentication for this board.

I remind our users at my site never to click on a link by itself in a message, even from a friend.
The small amount of effort it takes for the sender to say something, anything, about the link gives the recipient a lot better feel about whether it came from the expected person or from some person or bot that gained access to his/her account.

You can still fall prey to generic messages ("Here's a joke you'll like"), but, so far, mostly the bad guys haven't even bothered. (If they include an English sentence, that would be a give away to the German recipients, etc.)  But, even if they did that with a library of a few hundred such generic messages, we would soon recognize this ploy.