both etrade and american express send click tracking links via email that are http://, which makes them trivially redirectable to phishing sites.