In that case, I will explain to the readers why the link can look real in an email and not necessarily be real. If a link looks like the one JTB posted, which was the regular https://www.pp.com/cgi-bin/webscr?cmd=_login-run you need to visit to login to pp, then sometimes a different address can be hidden behind it. So, even though a link can look like the genuine pp link, it can actually link elsewhere, much like this:
https://www.pp.com/cgi-bin/webscr?cmd=_login-run
As you can see, the text is the same as the pp link above, but the link behind it can be something very different indeed. Oh, the site behind that link is perfectly safe, by the way. I'd not be that evil.