A fake Booking.com phishing email offers a $500 travel credit using your real name, a tight deadline and a dangerous "Redeem Now" button to steal logins.