It always pays to be suspicious these days, I never would respond to any hotel's request to "confirm" my credit card details if I'd booked directly through a third party site like booking.com and I'd tell the hotel to talk to booking.com, since they're who I have paid, not my problem.
Although I'm not surprised people get taken in - companies also have themselves to blame. They seem incapable of actually writing the pertitent information in the message or the email.
Why would a hotel send you a URL to access door codes rather than writing it in the message itself?!
Probably the same idiots at Barclays bank that decided to write their emails - they email saying 'We just wanted to remind you that changes to your savings rates take effect on 4 August 2025. Please search ‘Barclays savings interest rates’ online for more details.'. Why the F should I, you emailed me, so just write the previous and new interest rates in the damn message rather than clogging up my emails with another message and making me do more work?
Or, perhaps a travel agent I bought a flight from and constantly sending me reminders to check in online, yet the airline didn't offer online checkin for people flying from certain airports, only at the desk. If you followed the address, it would try and log you into the backoffice of the airline's portal for travel agents. Very confusing!