Bitly is not the final destination
The bit.ly domain tells you the link is shortened; it does not tell you where the link ends. The important question is the final domain after redirects.
Check the destination
Compare it with the sender's context
Avoid sensitive actions on unexpected domains