Research and victim phishing reports tell same sad story
securityskeptic.typepad.com