Net Security has an interview with Nitesh Dhanjani and Billy Rios, two "well-known security researchers that have recently managed to infiltrate the phishing underground." In it, "they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, discuss how phishers communicate and even how they phish each other."
To skip to the conclusion, in case you don't get that far, Dhanjani points out that the real problem is the use of static identifiers, of which credit cards and PINs are the most familiar example. We know they aren't good enough, but they are cheaper for the banks. He says:
We aren't going to solve the problem of online PII (Personally Identifiable Information) and identify theft just by writing even more secure code (although it certainly helps), or by continuing to play whack-a-mole with phishers. The system of relying on static identifiers to commit financial transactions needs to be rethought.
Commercial financial institutions such as credit card companies and banks realize that the cost of implementing a new system that does not merely rely on static identifiers is higher than the fraud committed, so they decide to accept the cost. This is the reason why the system has not changed. Unfortunately, financial institutions only take into account their cost when making this decision, but it also ends up affecting the lives of millions of people who have to pay with their identities when such fraud is committed.
Of course, some banks are already using two-factor authentication, especially in Germany. (Barclays was the first in he UK.) However, it's not foolproof.
