These phishers are wickedly clever, and they put stuff in their messages to fake exactly the things you'd look for as indications of authenticity. I'll bet you hovered the mouse over a link and watched the status line to see if the address looked reasonable. Well, guess what: Status line text can be faked with a little script. In fact, those sample letters all used the trick to make it look like the links were hot when in fact you'd get a little popup message if you tried to click them (thoughtful of them--it wouldn't be nice to actually direct their audience to sites that may try to deposit a virus or trojan or do other evil things). It gave me some problems evaluating the letters, since I use View Source to check out the actual links and look for the trick--they obscured a major piece of evidence.

The point is, there's no such thing as too much paranoia when it comes to these phishing and scam letters. You have to assume that the bad guys are really, really clever with the technology they're perverting, and that no matter how smart you are with the stuff yourself, it's likely that there's somebody out there who's smarter.

I missed one fraudulent letter in the test. That means that my defenses are only 90% effective. And I'm supposed to be some kind of alpha geek.

Be afraid. Be very afraid.