Dear AT&T Universal Card

I've been a customer of yours for several years. I'm a big fan of your online account-management system. So it shocks me to see what a boneheaded thing you did last week in e-mail.

I got a promotional message in HTML from you about some deal involving a low interest rate for transferring balances from other cards. I know it was from you because a) the headers looked legit and b) the message included the last four digits of my credit-card number. Embedded in the message is, of course, a clickable link to take advantage of this wonderful offer - balancetransfer.universalcard.com But when I moused over the link, I saw that it actually goes to another URL: info.citicards.com

Let me get this straight: You're a major credit-card company and you haven't heard how phishing works?