Don't Try This At Home For Entertainment Purposes Only Yes, I really mean it Be out of reach of the law Eastern Europe China Russia Style points: Diplomatic immunity Pick your target PayPal, eBay (not so good), banks, credit unions In reserve: casinos, email Style points: George Bush Create your HTML Save it directly from the site Style points: Blag it off another phisher Hack it around; fix the links; maybe mirror the images Use formmail or similar Hassle the user with forms Style points: Ask for mother's maiden name and pet's name Register a domain, perhaps If you do, pick a similar one, use stroppy registrars, and Style points: hijack the real domain Get a certificate? Probably not... Root a box Or buy one, cheap Style points: make it a .mil Double style points: www.lugradio.org Upload and test the site Redirect to the original Work out distribution mechanism Stolen customer lists Scraping the web CDs Write your spam Dear Valued Customer Or email address Scare them Give them a deadline - urgency Useful words and phrases: billing problems reverification Obfuscate URL Style points: spell everything correctly Send out spam Use a spamming service Use your own rooted boxes Do it at the weekend take advantage of timezones Wait for the harvest Use mules to get the money International fund transfers are monitored Transfer money to themselves, withdraw, send by mail Find them on IRC They take a cut Profit In seriousness: - It is a problem - We are working on it at the browser side - Only one small piece of the puzzle